Re: [PATCH 1/3] wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

[Johannes Berg]

On Sat, 2026-06-13 at 02:50 +0800, Zhao Li wrote:
> cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() read the frame
> control field without first checking len >= 2, then dispatch into
> subtype handlers that assume their fixed fields are present.
> 
> Add a frame-control length gate, then validate each subtype's minimum
> frame size in an if/else-if chain that mirrors the dispatch logic.
> Trace only after the frame is known to be well-formed.
> 
> Side effects of this change:
>  - The WARN_ON(len < 2) is replaced by a silent early return, since
>    these cfg80211 callbacks can legitimately receive short frames from
>    drivers.

Can they? How?

johannes