shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-26 04:20:23 +09:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mac80211: check S1G action frame size

Browse Source 
[ Upstream commit 19e4a47ee7 ]

Before checking the action code, check that it even
exists in the frame.

Reported-by: syzbot+be9c824e6f269d608288@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Johannes Berg
2023-08-15 17:51:05 +02:00
committed by Greg Kroah-Hartman
parent e08333e2ab
commit fedd9377dd
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
net/mac80211/rx.c
View File

@@ -3557,6 +3557,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
break;
goto queue;
case WLAN_CATEGORY_S1G:
if (len < offsetofend(typeof(*mgmt),
u.action.u.s1g.action_code))
break;
switch (mgmt->u.action.u.s1g.action_code) {
case WLAN_S1G_TWT_SETUP:
case WLAN_S1G_TWT_TEARDOWN: