[PATCH 0/1] wifi: mac80211: drop oversized fragments to avoid extra_len overflow

[Yuchao Zhang]

Hi Johannes and mac80211 maintainers,

During static analysis of fragment reassembly in mac80211, we identified
a potential 16-bit integer overflow in ieee80211_rx_h_defragment() that
can be triggered by a sequence of oversized fragments, leading to an
undersized allocation in pskb_expand_head() followed by skb_over_panic()
in softirq context.

In commit 69f132236827 ("mac80211: shrink struct
ieee80211_fragment_entry"), entry->extra_len was narrowed from unsigned
int to u16. Since up to 16 fragments (frag numbers 0..15) can be received
in an IEEE 802.11 sequence, a sequence of large incoming fragments can
cause entry->extra_len to exceed 65535 bytes, wrapping around modulo
65536. When the final fragment arrives, pskb_expand_head() only allocates
tailroom for the wrapped-around extra_len, and the subsequent
skb_put_data() loop overflows the buffer, triggering skb_over_panic().

Because valid MSDUs in IEEE 802.11 are far below U16_MAX (standard MSDU
is <= 2304 bytes, and A-MSDU cannot be fragmented), we prevent this wrap
by dropping the frame and purging the queued fragments if accumulating
the incoming fragment length would exceed U16_MAX.

This approach keeps struct ieee80211_fragment_entry completely untouched,
preserving the structure memory reduction from the aforementioned commit.

Best regards,
Yuchao Zhang

Yuchao Zhang (1):
  wifi: mac80211: drop oversized fragments to avoid extra_len overflow

 net/mac80211/rx.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
2.53.0