From: Johannes Berg <johannes@sipsolutions.net>
To: Zhao Li <enderaoelyther@gmail.com>
Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/3] wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
Date: Tue, 07 Jul 2026 09:21:23 +0200 [thread overview]
Message-ID: <66f148d83eb9f0970b9abbccc85d1b61244e54ad.camel@sipsolutions.net> (raw)
In-Reply-To: <20260707025241.22223-1-enderaoelyther@gmail.com> (sfid-20260707_045255_477753_F3C5731E)
On Tue, 2026-07-07 at 10:52 +0800, Zhao Li wrote:
>
> mwifiex accepts a 4-address
> ieee80211_hdr plus the 2-byte firmware length prefix. After it strips
> the prefix and removes addr4, pkt_len can be exactly 24: a bare
> 3-address management header with no reason-code body.
> WARN_ON(len < 2) does not fire on that, and cfg80211_process_deauth()
> then reads u.deauth.reason_code as a two-byte access starting at offset
> 24, immediately past the 24-byte buffer.
Right, thanks for the explanations here (and in the other mail). I'm
fairly sure the firmware would (have to) discard such frames, but we
shouldn't rely on it. Looks like mwifiex is pretty much a trainwreck on
this anyway though, e.g. mwifiex_parse_mgmt_packet()? I vaguely remember
fixing something like this but I guess it was elsewhere ...
johannes
next prev parent reply other threads:[~2026-07-07 7:21 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-12 18:50 Zhao Li
2026-06-12 18:50 ` [PATCH 2/3] wifi: cfg80211: validate assoc response length before status and IE access Zhao Li
2026-07-06 10:39 ` Johannes Berg
2026-07-07 3:17 ` Zhao Li
2026-06-12 18:50 ` [PATCH 3/3] wifi: mac80211: validate deauth frame length before reason access Zhao Li
2026-07-06 10:37 ` [PATCH 1/3] wifi: cfg80211: validate rx/tx MLME callback frame lengths before access Johannes Berg
2026-07-07 2:52 ` Zhao Li
2026-07-07 7:21 ` Johannes Berg [this message]
2026-07-07 2:53 ` [PATCH v2 " Zhao Li
2026-07-07 2:53 ` [PATCH v2 2/3] wifi: cfg80211: validate assoc response length before status and IE access Zhao Li
2026-07-07 2:53 ` [PATCH v2 3/3] wifi: mac80211: validate deauth frame length before reason access Zhao Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=66f148d83eb9f0970b9abbccc85d1b61244e54ad.camel@sipsolutions.net \
--to=johannes@sipsolutions.net \
--cc=enderaoelyther@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®