Re: [PATCH 1/3] wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

[Johannes Berg]

On Tue, 2026-07-07 at 10:52 +0800, Zhao Li wrote:
> 
> mwifiex accepts a 4-address
> ieee80211_hdr plus the 2-byte firmware length prefix. After it strips
> the prefix and removes addr4, pkt_len can be exactly 24: a bare
> 3-address management header with no reason-code body.
> WARN_ON(len < 2) does not fire on that, and cfg80211_process_deauth()
> then reads u.deauth.reason_code as a two-byte access starting at offset
> 24, immediately past the 24-byte buffer.

Right, thanks for the explanations here (and in the other mail). I'm
fairly sure the firmware would (have to) discard such frames, but we
shouldn't rely on it. Looks like mwifiex is pretty much a trainwreck on
this anyway though, e.g. mwifiex_parse_mgmt_packet()? I vaguely remember
fixing something like this but I guess it was elsewhere ...

johannes