mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-01-04 04:06:26 +00:00
wifi: mac80211: check S1G action frame size
[ Upstream commit 19e4a47ee7
]
Before checking the action code, check that it even
exists in the frame.
Reported-by: syzbot+be9c824e6f269d608288@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
b39c24e977
commit
5e030a2509
@ -3734,6 +3734,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
|
||||
break;
|
||||
goto queue;
|
||||
case WLAN_CATEGORY_S1G:
|
||||
if (len < offsetofend(typeof(*mgmt),
|
||||
u.action.u.s1g.action_code))
|
||||
break;
|
||||
|
||||
switch (mgmt->u.action.u.s1g.action_code) {
|
||||
case WLAN_S1G_TWT_SETUP:
|
||||
case WLAN_S1G_TWT_TEARDOWN:
|
||||
|
Loading…
Reference in New Issue
Block a user