Re: [PATCH] wifi: mwifiex: Fix use after free in mwifiex_11n_dispatch_amsdu_pkt()

[Johannes Berg]

On Thu, 2026-01-08 at 22:57 +0300, Dan Carpenter wrote:
> @@ -44,7 +45,7 @@ static int mwifiex_11n_dispatch_amsdu_pkt(struct mwifiex_private *priv,
>  			    ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {
>  				mwifiex_process_tdls_action_frame(priv,
>  								  (u8 *)rx_hdr,
> -								  skb->len);
> +								  skb_len);

I'm 99% sure that should be rx_skb->len at this point, it can't want to
handle a single A-MSDU encapsulated action as if it was as long as the
entire A-MSDU that held it, that'd likely crash (too), especially if it
wasn't the first frame in it.

johannes