[PATCH ath-next 0/2] wifi: ath11k/ath12k: drop TKIP frames too short for the Michael MIC

[PATCH ath-next 0/2] wifi: ath11k/ath12k: drop TKIP frames too short for the Michael MIC

[Julius Bairaktaris]

ath11k and ath12k check the Michael MIC of a reassembled TKIP frame in
the driver. Both compute the length of the MIC-protected data in a
size_t without checking that the frame is long enough, so a peer that
holds the TKIP key and sends two fragments with fewer than 16 payload
bytes between them wraps the length, and michael_mic() reads on from the
skb data until it faults. Each patch drops such a frame before the
subtraction, as mac80211 does in its own MIC check.

I used Claude (Anthropic) to help write these patches.

Julius Bairaktaris (2):
  wifi: ath12k: drop TKIP frames too short for the Michael MIC
  wifi: ath11k: drop TKIP frames too short for the Michael MIC

 drivers/net/wireless/ath/ath11k/dp_rx.c       | 5 +++++
 drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 5 +++++
 2 files changed, 10 insertions(+)


base-commit: d0fbb39d65dc9dcb4175fa6b23e473dec3670f4d
-- 
2.53.0

[PATCH ath-next 1/2] wifi: ath12k: drop TKIP frames too short for the Michael MIC

[Julius Bairaktaris]

ath12k_wifi7_dp_rx_h_verify_tkip_mic() computes the length of the
MIC-protected data of a reassembled TKIP frame as msdu->len - head_len -
tail_len in a size_t, without checking that the frame holds the header,
IV, MIC, ICV and FCS. Defragmentation trims the MIC and ICV from every
fragment but the last and the IV from every fragment but the first, so
fragments that carry fewer than 16 payload bytes between them leave a
frame shorter than head_len + tail_len. data_len then wraps, and
michael_mic() reads on from the skb data until it faults.

Drop such a frame, as mac80211 drops a frame shorter than the MIC in
ieee80211_rx_h_michael_mic_verify().

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Cc: stable@vger.kernel.org
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
---
 drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
index a32c804403e8a..56f0673d2b6d4 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
@@ -1030,6 +1030,11 @@ static int ath12k_wifi7_dp_rx_h_verify_tkip_mic(struct ath12k_pdev_dp *dp_pdev,
 	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
 	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
 
+	if (msdu->len < head_len + tail_len) {
+		dev_kfree_skb_any(msdu);
+		return -EINVAL;
+	}
+
 	if (!is_multicast_ether_addr(hdr->addr1))
 		key_idx = peer->ucast_keyidx;
 	else
-- 
2.53.0

[PATCH ath-next 2/2] wifi: ath11k: drop TKIP frames too short for the Michael MIC

[Julius Bairaktaris]

ath11k_dp_rx_h_verify_tkip_mic() computes the length of the
MIC-protected data of a reassembled TKIP frame as msdu->len - head_len -
tail_len in a size_t, without checking that the frame holds the header,
IV, MIC, ICV and FCS. Defragmentation trims the MIC and ICV from every
fragment but the last and the IV from every fragment but the first, so
fragments that carry fewer than 16 payload bytes between them leave a
frame shorter than head_len + tail_len. data_len then wraps, and
michael_mic() reads on from the skb data until it faults.

Drop such a frame, as mac80211 drops a frame shorter than the MIC in
ieee80211_rx_h_michael_mic_verify().

Fixes: 243874c64c81 ("ath11k: handle RX fragments")
Cc: stable@vger.kernel.org
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
---
 drivers/net/wireless/ath/ath11k/dp_rx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 6d95f7b343a55..f77a45b7bf84a 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -3270,6 +3270,11 @@ static int ath11k_dp_rx_h_verify_tkip_mic(struct ath11k *ar, struct ath11k_peer
 	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
 	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
 
+	if (msdu->len < head_len + tail_len) {
+		dev_kfree_skb_any(msdu);
+		return -EINVAL;
+	}
+
 	if (!is_multicast_ether_addr(hdr->addr1))
 		key_idx = peer->ucast_keyidx;
 	else
-- 
2.53.0

Re: [PATCH ath-next 0/2] wifi: ath11k/ath12k: drop TKIP frames too short for the Michael MIC

[Jeff Johnson]

On 11/11/2026 12:06 AM, Julius Bairaktaris wrote:
> ath11k and ath12k check the Michael MIC of a reassembled TKIP frame in
> the driver. Both compute the length of the MIC-protected data in a
> size_t without checking that the frame is long enough, so a peer that
> holds the TKIP key and sends two fragments with fewer than 16 payload
> bytes between them wraps the length, and michael_mic() reads on from the
> skb data until it faults. Each patch drops such a frame before the
> subtraction, as mac80211 does in its own MIC check.
> 
> I used Claude (Anthropic) to help write these patches.
> 
> Julius Bairaktaris (2):
>   wifi: ath12k: drop TKIP frames too short for the Michael MIC
>   wifi: ath11k: drop TKIP frames too short for the Michael MIC
> 
>  drivers/net/wireless/ath/ath11k/dp_rx.c       | 5 +++++
>  drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 5 +++++
>  2 files changed, 10 insertions(+)
> 
> 
> base-commit: d0fbb39d65dc9dcb4175fa6b23e473dec3670f4d

Is this a theoretical change or are you able to have firmware pass too short
frames to the host?

Maintainers are being overwhelmed with "fixes" that are theoretical and which
do not occur with known versions of firmware.

I (and the stable team) need to spend our time on exploitable bugs, not theory.

/jeff