diff options
| author | Zhao Li <enderaoelyther@gmail.com> | 2026-06-13 02:50:45 +0800 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-07-06 12:28:25 +0200 |
| commit | f843cf31dfc2c75843362a8f7e75180ed0cc44d6 (patch) | |
| tree | 6914d2df9741d87c5b10f92a7057cd91aa9de220 | |
| parent | 74c604442f3d7a1df7873a44ca5ebe453be7e544 (diff) | |
| download | linux-next-f843cf31dfc2c75843362a8f7e75180ed0cc44d6.tar.gz linux-next-f843cf31dfc2c75843362a8f7e75180ed0cc44d6.zip | |
wifi: mac80211: validate deauth frame length before reason access
ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking
that the fixed field is actually present in the received frame.
Validate the deauth frame length first and only then read the reason
code.
Assisted-by: Codex:gpt-5.5
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260612185042.66260-6-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/mlme.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 86c90b504cfd..fa773f3b0541 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -5641,13 +5641,15 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt, size_t len) { struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; - u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); + u16 reason_code; lockdep_assert_wiphy(sdata->local->hw.wiphy); - if (len < 24 + 2) + if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code)) return; + reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); + if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); return; |