mwifiex_process_mgmt_packet() accepts an rx_pkt_length as small as a four-address struct ieee80211_hdr plus the two-byte firmware length prefix. After stripping the prefix, mwifiex_parse_mgmt_packet() can receive a buffer equal to sizeof(struct ieee80211_hdr). For action frames, the parser reads the category byte immediately after that header and, for a public action frame, reads the following action code byte without verifying that either field is present. A minimal frame therefore reads one or two bytes beyond the RX buffer. Require the category and public action-code fields before reading them. mwifiex parses the firmware four-address layout before removing addr4, so add ETH_ALEN to the standard IEEE80211_MIN_ACTION_SIZE() offsets. Suggested-by: Johannes Berg Fixes: 72e5aa8d2a6d ("mwifiex: support for parsing TDLS discovery frames") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/66f148d83eb9f0970b9abbccc85d1b61244e54ad.camel@sipsolutions.net/ Link: https://lore.kernel.org/all/20260708195911.84365-8-enderaoelyther@gmail.com/ Link: https://lore.kernel.org/all/20260723011013.76968-1-enderaoelyther@gmail.com/ Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li --- Changes in v3: - Drop the redundant parser-local header check; the caller already guarantees the complete four-address header after removing the two-byte firmware prefix. Changes in v2: - Express the action-field sizes with IEEE80211_MIN_ACTION_SIZE(), accounting for the firmware four-address layout. --- drivers/net/wireless/marvell/mwifiex/util.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c index 7d3631d21223..e54a86ecaa33 100644 --- a/drivers/net/wireless/marvell/mwifiex/util.c +++ b/drivers/net/wireless/marvell/mwifiex/util.c @@ -317,9 +317,15 @@ mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len, switch (stype) { case IEEE80211_STYPE_ACTION: + if (len < IEEE80211_MIN_ACTION_SIZE(category) + ETH_ALEN) + return -1; + category = *(payload + sizeof(struct ieee80211_hdr)); switch (category) { case WLAN_CATEGORY_PUBLIC: + if (len < IEEE80211_MIN_ACTION_SIZE(action_code) + ETH_ALEN) + return -1; + action_code = *(payload + sizeof(struct ieee80211_hdr) + 1); if (action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) { -- 2.50.1 (Apple Git-155)