github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mac80211: fix TDLS setup frame length check

Browse Source 
If TDLS setup packets are created by AF_PACKET or so, then
the payload may not be present. Since we only care about
those mac80211 generated (which are linear), just replace
the skb->len check with a skb_headlen() check to avoid any
out-of-bounds accesses.

Assisted-by: LLM
Link: https://patch.msgid.link/20261005224950.c3cf023d5191.Id537db8aca13e6df999938a3bc4cc6ce2a28f733@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Johannes Berg 2026-10-05 22:48:01 +02:00
parent a5f361bc57
commit 2f4bb025e9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/mac80211/tx.c
View File

@ -2606,7 +2606,7 @@ static inline bool ieee80211_is_tdls_setup(struct sk_buff *skb)
u16 ethertype = (skb->data[12] << 8) | skb->data[13];
return ethertype == ETH_P_TDLS &&
skb->len > 14 &&
skb_headlen(skb) > 14 &&
skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
}