github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 18:21:24 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: rtlwifi: validate action frame size before using in _rtl_pci_tx_isr()

Browse Source 
Since TX action frames might be malformed, validate the size before using.

Tested on RTL8723BE.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260414062229.21047-4-pkshih@realtek.com
This commit is contained in:
Ping-Ke Shih 2026-04-14 14:22:29 +08:00
parent c9f10419c3
commit 043f09bb78
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/net/wireless/realtek/rtlwifi/pci.c
View File

@ -505,9 +505,10 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
}
}
if (ieee80211_is_action(fc)) {
struct ieee80211_mgmt *action_frame =
(struct ieee80211_mgmt *)skb->data;
if (action_frame->u.action.action_code ==
struct ieee80211_mgmt *action_frame = (void *)skb->data;
if (skb->len >= IEEE80211_MIN_ACTION_SIZE(action_code) &&
action_frame->u.action.action_code ==
WLAN_HT_ACTION_SMPS) {
dev_kfree_skb(skb);
goto tx_status_ok;