A received S1G TWT setup frame is length-checked in ieee80211_process_rx_twt_action() before it is queued: it requires skb->len >= IEEE80211_MIN_ACTION_SIZE + sizeof(twt_setup) + 2 and then skb->len >= IEEE80211_MIN_ACTION_SIZE + 3 + twt->length, where twt->length is attacker-controlled. twt->length can be as small as 3 (the control byte plus the 2-byte req_type) and the frame still passes, so only those bytes are guaranteed present. For an individual (non-broadcast) agreement, ieee80211_s1g_rx_twt_setup() calls drv_add_twt_setup(), and both trace_drv_add_twt_setup() and the driver ->add_twt_setup() callback read the full struct ieee80211_twt_params via twt->params (req_type, twt, min_twt_dur, mantissa, channel). That needs twt->length >= sizeof(twt->control) + sizeof(struct ieee80211_twt_params) = 15, so with the minimal 3-byte element they read up to 12 bytes past the end of the frame. The broadcast path only rejects the agreement and touches req_type, which is always present, so it is unaffected. For the individual path, require twt->length to cover the control byte plus a full ieee80211_twt_params block before calling drv_add_twt_setup(), and drop the frame otherwise. Fixes: f5a4c24e689f ("mac80211: introduce individual TWT support in AP mode") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li --- net/mac80211/s1g.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mac80211/s1g.c b/net/mac80211/s1g.c index 5af4a0c6c6424..abc338e22e59c 100644 --- a/net/mac80211/s1g.c +++ b/net/mac80211/s1g.c @@ -101,6 +101,10 @@ ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata, struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.s1g.variable; struct ieee80211_twt_params *twt_agrt = (void *)twt->params; + if (!(twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) && + twt->length < sizeof(twt->control) + sizeof(*twt_agrt)) + return; + twt_agrt->req_type &= cpu_to_le16(~IEEE80211_TWT_REQTYPE_REQUEST); /* broadcast TWT not supported yet */ -- 2.50.1 (Apple Git-155)