From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 125A039FCCA for ; Fri, 12 Jun 2026 18:50:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781290256; cv=none; b=QvOcOWZdo+qTs9jbXY9sydXyldbdyUUenveQ/J4qiZVeUjno2O3E7vmK01v0bHyz20JQcH9C6ocd821kB0lQUrR1xZ67IA6f+Z8sMhLrSz1NwIpDj52icao5eKVKaMsx+KZXgXOf+5UuIOy0iBoHFJONzYxfVTi7nzrNYTJbYZM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781290256; c=relaxed/simple; bh=hlcOSpzCIeLy9An8PLGHbmJPvzwoOQPxOMGo6PLPsS0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cPql31dYv7cSMPBmOMlWAziZpnexKMdr6LAecJ/yn1iGus6UnnBNULF7yykU6QJ9pvoUt3eJc5lEpkFZy1uUObEKF10BJJUKjl+3Fk3CgqPFHjqpr8Wny4exmiM+86XSx4PM+xMMESOq3xwKKVmMom2lnEYPPElW2DRxrS+2bSA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iarCaaC4; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iarCaaC4" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-36b9d265355so695588a91.2 for ; Fri, 12 Jun 2026 11:50:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781290254; x=1781895054; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=DhYmWtYKzLZAshiSMxu3UaHeW+9G/xRMBLm0pBnYPNk=; b=iarCaaC4vnCYvLrFhvGftRiRKARzuhPRpndN0cgHG8D5gs9Gp3yqvHRncIoSnEQKXk FgIckTSXSKVn2n9foQsIrUGGL9LJY514ELyl0G3A5w8mxqVt4x2TqrYfwTrpanjXBUOX nsqrfYO6m005h9GxwtkM6O64wfvan1JjmxlH9iAf5urcRtqNrMPtdF9Ntkvh9egY+w0Z 4LlE0tdVYhbKio8yYTTCzQ+QArjCcQbVlajIn26RSVaTi9x8Ttx04VRHoHxhrkPPzcMy yOhxzIHzVmkL3uY2wlcdhJ8BoShj6DbFj2YvnAxGfb9jZHByr8J34VaiVFQzOCTF+9/l cWGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781290254; x=1781895054; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=DhYmWtYKzLZAshiSMxu3UaHeW+9G/xRMBLm0pBnYPNk=; b=kHOuUNy8fq1XLAkizvwrvUS0xk5bgpTK6o7MdtbBbOC/eAdqIzXKpUBZ8KD8HPoR8F bKS5PPNKP1V3MxLSCZmMUs1rAZkYiukiakJv0dXv4CNKdmwYELsSuXf1rpBCG9r7hGjB rjRy5qFR5oZA3p1SC0pySgtAMny2R0k72/VmaXCS+btf39YPdHXUolYtp5jht8oAzNQB YDk+cGPwnBtUq8Y96wlr1Oc+OVPl6aEXAAWBQwL2l6Ynan1WzkpTw7fserqzeCTV81Rb 0H++K3I9U0KTKL7W+/+RD9UXEmh0dF/dgH0ZGt8bfjjqgMTAOuXxJPTJbaig02f/q4ou 04bw== X-Forwarded-Encrypted: i=1; AFNElJ8w7t5ei/uqijjXR68InZOth1xkfng69dy7P3LSiQi992yA2IS6FC2ouQASDaxGAygDJKcdLe0mEP7f6Mg=@vger.kernel.org X-Gm-Message-State: AOJu0YylLPnuz/4QqrARtQOqJMAVZmWX8coPfYytPihKiBODhXEk5rPs pQOJbzfwmfNeC84Eb6LWsljTeqkn+eUbo7qKzLr2KPc5jmbzaCg8jX0D X-Gm-Gg: Acq92OFL1qUaWSGxxJPyID60oyWpjAseW0XULrWhvTQZUTceXMKc6KYs/sNXxvKiVZ3 HFa9/XZvImil48rnbPm7+z6kjMewqhBjVmHtJIE1AvSm6Uo58QpURcBEknqOQJVQ7tIv9ZLNWUR ISUtovrh+P/ntNrcpw3+luVoNXtAGbfIIfHnTy5nuiY7p3AFa2kfZEUqSJ5+ljPTQF0l9Vi1Ae5 fHuH6F7KhJ/LQOCgF/FMKILcPM6VrtDoP1DgysGlIKAgXHfSpnYACrYHzXtvZxxhOf73P/hiJ5K 3iKiiSfbk8KyEKOh9G0yARoZE1np45OJuFkwR0RK+h0+X2OlO2tDgkbLJ1DY7LJUUptcJtS8jRx PmQmwrshm8FMXYqfaXJblUwEv/H2PwWF6OJ6ub4X5C2WRtIRDmcaJ3HYZoJQHkn+07G1YC2Nnn+ a7wodcGADHsdvI4k9/6FSDziFeuDf5CtIh2PrWA0FIDtaM3sqC2Rqr8gBgLuSSDq3zoXxMCF7Kp A== X-Received: by 2002:a17:903:41cd:b0:2c0:a373:89b9 with SMTP id d9443c01a7336-2c40ff3a3demr46700605ad.6.1781290254330; Fri, 12 Jun 2026 11:50:54 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([139.177.225.248]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c432d8a039sm28464465ad.62.2026.06.12.11.50.52 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 12 Jun 2026 11:50:54 -0700 (PDT) From: Zhao Li To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/3] wifi: mac80211: validate deauth frame length before reason access Date: Sat, 13 Jun 2026 02:50:45 +0800 Message-ID: <20260612185042.66260-6-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260612185042.66260-4-enderaoelyther@gmail.com> References: <20260612185042.66260-4-enderaoelyther@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code. Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li --- net/mac80211/mlme.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index b98ddfa3003e1..8be470d730f52 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -5179,13 +5179,15 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt, size_t len) { struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; - u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); + u16 reason_code; lockdep_assert_wiphy(sdata->local->hw.wiphy); - if (len < 24 + 2) + if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code)) return; + reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); + if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); return; -- 2.50.1 (Apple Git-155)