wifi: mac80211: check EHT/TTLM action frame length
Check the EHT action frame length before accessing
the action code, if it's not present then the frame
cannot be valid.
Reported-by: syzbot+75af45a00cf13243ba39@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/0000000000006c06870614886611@google.com/
Fixes: 8f500fbc6c
("wifi: mac80211: process and save negotiated TID to Link mapping request")
Link: https://msgid.link/20240326213858.19c84f34349f.I71b439f016b28f65284bb7646fe36343b74cbc9a@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
@ -3780,6 +3780,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
|
||||
}
|
||||
break;
|
||||
case WLAN_CATEGORY_PROTECTED_EHT:
|
||||
if (len < offsetofend(typeof(*mgmt),
|
||||
u.action.u.ttlm_req.action_code))
|
||||
break;
|
||||
|
||||
switch (mgmt->u.action.u.ttlm_req.action_code) {
|
||||
case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
|
||||
if (sdata->vif.type != NL80211_IFTYPE_STATION)
|
||||
|
Reference in New Issue
Block a user