mwifiex_process_mgmt_packet() accepts an rx_pkt_length as small as a 4-address struct ieee80211_hdr plus the 2-byte firmware length prefix. After the prefix is stripped, mwifiex_parse_mgmt_packet() can be called with len equal to sizeof(struct ieee80211_hdr). For an action frame the parser then reads the category byte just past that header, and for a public action frame the action code at the next byte, without checking that len covers them. A minimal-length action frame therefore causes a one- or two-byte read past the end of the RX buffer. Reject frames shorter than the header, and require the category and (for public action frames) action-code bytes to be present before reading them. Suggested-by: Johannes Berg Fixes: 72e5aa8d2a6d ("mwifiex: support for parsing TDLS discovery frames") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/66f148d83eb9f0970b9abbccc85d1b61244e54ad.camel@sipsolutions.net/ Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li --- drivers/net/wireless/marvell/mwifiex/util.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c index 7d3631d212236..e2d76c2d9b05b 100644 --- a/drivers/net/wireless/marvell/mwifiex/util.c +++ b/drivers/net/wireless/marvell/mwifiex/util.c @@ -313,13 +313,22 @@ mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len, u8 category, action_code, *addr2; struct ieee80211_hdr *ieee_hdr = (void *)payload; + if (len < sizeof(*ieee_hdr)) + return -1; + stype = (le16_to_cpu(ieee_hdr->frame_control) & IEEE80211_FCTL_STYPE); switch (stype) { case IEEE80211_STYPE_ACTION: + if (len < sizeof(*ieee_hdr) + 1) + return -1; + category = *(payload + sizeof(struct ieee80211_hdr)); switch (category) { case WLAN_CATEGORY_PUBLIC: + if (len < sizeof(*ieee_hdr) + 2) + return -1; + action_code = *(payload + sizeof(struct ieee80211_hdr) + 1); if (action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) { -- 2.50.1 (Apple Git-155)