From: Johannes Berg <[email protected]>
Check the EHT action frame length before accessing
the action code, if it's not present then the frame
cannot be valid.
Reported-by: [email protected]
Closes: https://lore.kernel.org/r/[email protected]/
Fixes: 8f500fbc6c65 ("wifi: mac80211: process and save negotiated TID to Link mapping request")
Signed-off-by: Johannes Berg <[email protected]>
---
net/mac80211/rx.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c1f850138405..685185dc04f9 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3780,6 +3780,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_PROTECTED_EHT:
+ if (len < offsetofend(typeof(*mgmt),
+ u.action.u.ttlm_req.action_code))
+ break;
+
switch (mgmt->u.action.u.ttlm_req.action_code) {
case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
if (sdata->vif.type != NL80211_IFTYPE_STATION)
--
2.44.0