From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A0FC37DEAF for ; Tue, 7 Jul 2026 02:53:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783392829; cv=none; b=EJ8HuHhtvZ+paXEgrRMNvD0Q/2suksZtTPbvllwGNtR4uAZUojv0kARuhpjqS+AC41+C9oP2AJ9dgdVLKsohtNy+LvQYQEInbBzGSD3ESIQXYtDnp59lipMMTHCqJxC4o/ZKhUp1W6mSi9vOreXCvaqrPAy4+dySNZTC4d5mCWc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783392829; c=relaxed/simple; bh=AZbxg47109ou2s/tC9r7vzmknWS79mY7FNjCTbfprco=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eDcf+gY93HkKho/1p/xNIvmrYdi2XJ2uhm8zM3gWaTpZ/6E1Xcjtp5giuWW/tKmr9UmTMZVr3PaqbbOyM+8Ij9FEl46haILV58QrxJxW2PZWLXWl+/1cTch4n7krOWqYVFRntznfnIXP1IegEYo1991SIsfPAn9f/+72L3CjcIQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=aC2fjKNL; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="aC2fjKNL" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-381891a9525so3400397a91.3 for ; Mon, 06 Jul 2026 19:53:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783392828; x=1783997628; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=W96W2yhOoeXT7Hln4eYd/7QaqID/7n7Di/L6+b58oH4=; b=aC2fjKNLfeMR9eSTDZo0au0y370e5L7kgK/cnrSAcxzuUXy3T35xAaBkSkKDdKK95a TvQ/xulZRIyDVOH5KgyneWx8NPt9FXc2IdY07R32kQUEgm+0X6CM7HsVOqbfp7boPpLi xdBPhNi+f8clnjUAIJ/xZHeCxFnVx2s06gfvCIm3RuruyFyqO+bLBVGKC5UWy4tqaf2e uKz/Ydw2EPaCtfKJyMffCAjDXjynV75wJ+RvTa5lBL+UdFWyuq56Qja7aMZYkpU3O/0c mEReRllZ31tqw7+/6rrB3VgTFN+8b52/6SKhCJ6avvByCA+2afRS+e8fdCuv4KhVDidb pGxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783392828; x=1783997628; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=W96W2yhOoeXT7Hln4eYd/7QaqID/7n7Di/L6+b58oH4=; b=HQr7kp5xZxJTdUEWXlydoYwiuBczM+WMOpzkC1FLoNPl6O/0nNcgTGuJyudzMCCHoG wsMLWi2NDjQHD83koWp+175iWDs5rPw17gk284Xa1diMtYd31kqdhYLKYu6I/TohWGOi wCL2fR6oG8CsOcod1xilVy5X4dvV1OhZXtCEIETJG3VV1nxUyitMj15ZjkqMXG4MMUJc ULl4JtmRZQF4hB3uXA/QeVIjR6tI8PM3eoJMWCUrEZgGeABbqbImdDx+K/ac+Ee7Vgk/ 7gd4pNKnqzKez4XaBWkvhKUnO0rEweYwebUe8Qkt9Z1cITCNhtYN5V/Rwve8DJFH+44W cX1w== X-Forwarded-Encrypted: i=1; AHgh+Rq8AphwWwCywkT32p7Wm6WEtPAIrmNjDj8cGF/ETqWKrVdKM8I7Ggg96AU+F1R2hSNOYHnH4pwbDUiSPMM=@vger.kernel.org X-Gm-Message-State: AOJu0YzYjWuy1xIP87ai9YRPJIm83xE7okMWtVhZc4KeN8jiR9fwRr7X SzSGoEoyQBYVT1IXHrD1OvJ6AJowW862NQ8EU3Ck/VADmqc2fOMjqPLg X-Gm-Gg: AfdE7ckpp87gf3ThmEnHwehFwwqFvpEhlok+GNA3zUo7NKH+xEuURyCkKoSrFQzV6qS NTGd2d9yeCvwJy/X84YgToi48EZcOp5Y2TOcYHcfyocOB17Nzxm6D42Lig1mE9BkgkX7PQYdKcX BBg2K2a5dUKg3YrMb2N6cyQZtupnsWxXQiTloaci9xN0UGrfUX3dZm0wosCEfmii021Tel2NAfR QuTWUmYdGeVyuxRUM8qs191YwrGosg9RIDISrZprQVioFw4w9wv2hJNF9tKElWooTd5eSJ4oAoU uOsf3RSmN0jcpmL37uckIx/9h//j3zuzRhMJCwtxSOeJjPH1hpV5k4JFYCl2Mt14tZkMpTYZyOw Vtd9lXWanTGkVaulu7vQrGQ13mQtFsfmAfdDjYzzq0Gy2qWOyocwYg10NZ4czkAZ8l7qot1W/SK mcEdOUI35HUdu5mVb2adRB37s+pzpROU2Wshwmsqs= X-Received: by 2002:a17:90b:390e:b0:381:270c:4dd1 with SMTP id 98e67ed59e1d1-387572b2e6amr3194440a91.20.1783392827837; Mon, 06 Jul 2026 19:53:47 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([2407:cdc0:606d:ba36:a6c6:36ae:a290:5cf]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f598dsm2755235eec.6.2026.07.06.19.53.45 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 06 Jul 2026 19:53:47 -0700 (PDT) From: Zhao Li To: Johannes Berg Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 3/3] wifi: mac80211: validate deauth frame length before reason access Date: Tue, 7 Jul 2026 10:53:36 +0800 Message-ID: <20260707025336.22557-3-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260707025336.22557-1-enderaoelyther@gmail.com> References: <488ed9862d5196b8f5ecf23f037fa6725fbe9a52.camel@sipsolutions.net> <20260707025336.22557-1-enderaoelyther@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code. Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li --- v2: No change. net/mac80211/mlme.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index b98ddfa3003e1..8be470d730f52 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -5179,13 +5179,15 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt, size_t len) { struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; - u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); + u16 reason_code; lockdep_assert_wiphy(sdata->local->hw.wiphy); - if (len < 24 + 2) + if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code)) return; + reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); + if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); return; -- 2.50.1 (Apple Git-155)