diff options
| author | Shahar Tzarfati <shahar.tzarfati@intel.com> | 2026-07-15 21:27:43 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-07-21 19:18:53 +0200 |
| commit | aa4c0a649903567762edf2bbc7fff608953b3ca4 (patch) | |
| tree | 1381364e592d45b8598e3600d66a07fb8b7f0c0a | |
| parent | 8ff047b9c7b2900ec6e49361f81d74ac61563cdc (diff) | |
| download | linux-aa4c0a649903567762edf2bbc7fff608953b3ca4.tar.gz linux-aa4c0a649903567762edf2bbc7fff608953b3ca4.zip | |
wifi: mac80211: ibss: read deauth reason_code after frame length check
The function was reading reason_code from the frame before validating
that the frame is at least IEEE80211_DEAUTH_FRAME_LEN bytes long.
Move the reason_code read to after the length check so the field is
guaranteed to be present before it is accessed.
Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715212706.db26604650bd.I2caa73c396b8c9d357224b9334d5df3cafac498e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/ibss.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c index d0fd6054f182..9915dd5c36df 100644 --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -881,11 +881,13 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt, size_t len) { - u16 reason = le16_to_cpu(mgmt->u.deauth.reason_code); + u16 reason; if (len < IEEE80211_DEAUTH_FRAME_LEN) return; + reason = le16_to_cpu(mgmt->u.deauth.reason_code); + ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason); sta_info_destroy_addr(sdata, mgmt->sa); |