diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2023-08-15 17:51:05 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2023-08-22 14:01:18 +0200 |
| commit | 19e4a47ee74718a22e963e8a647c8c3bfe8bb05c (patch) | |
| tree | d813800bb6894b43b4c0985575d5baf8515b85c6 /net | |
| parent | 6d2c360b4badf78fb778afe1f5b85196ff18383e (diff) | |
| download | linux-19e4a47ee74718a22e963e8a647c8c3bfe8bb05c.tar.gz linux-19e4a47ee74718a22e963e8a647c8c3bfe8bb05c.tar.bz2 linux-19e4a47ee74718a22e963e8a647c8c3bfe8bb05c.zip | |
wifi: mac80211: check S1G action frame size
Before checking the action code, check that it even
exists in the frame.
Reported-by: syzbot+be9c824e6f269d608288@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/rx.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 4f707d2a160f..33f9764b94de 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -3732,6 +3732,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx) break; goto queue; case WLAN_CATEGORY_S1G: + if (len < offsetofend(typeof(*mgmt), + u.action.u.s1g.action_code)) + break; + switch (mgmt->u.action.u.s1g.action_code) { case WLAN_S1G_TWT_SETUP: case WLAN_S1G_TWT_TEARDOWN: |