[PATCH 7/8] wifi: mwifiex: validate action frame fixed fields

[Zhao Li]

mwifiex_process_mgmt_packet() accepts an rx_pkt_length as small as a
4-address struct ieee80211_hdr plus the 2-byte firmware length prefix.
After the prefix is stripped, mwifiex_parse_mgmt_packet() can be called
with len equal to sizeof(struct ieee80211_hdr).

For an action frame the parser then reads the category byte just past
that header, and for a public action frame the action code at the next
byte, without checking that len covers them. A minimal-length action
frame therefore causes a one- or two-byte read past the end of the RX
buffer.

Reject frames shorter than the header, and require the category and
(for public action frames) action-code bytes to be present before
reading them.

Suggested-by: Johannes Berg <johannes@xxxxxxxxxxxxxxxx>
Fixes: 72e5aa8d2a6d ("mwifiex: support for parsing TDLS discovery frames")
Cc: stable@xxxxxxxxxxxxxxx
Link: https://lore.kernel.org/all/66f148d83eb9f0970b9abbccc85d1b61244e54ad.camel@xxxxxxxxxxxxxxxx/
Assisted-by: Codex:gpt-5
Assisted-by: Claude:opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
---
 drivers/net/wireless/marvell/mwifiex/util.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
index 7d3631d212236..e2d76c2d9b05b 100644
--- a/drivers/net/wireless/marvell/mwifiex/util.c
+++ b/drivers/net/wireless/marvell/mwifiex/util.c
@@ -313,13 +313,22 @@ mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len,
 	u8 category, action_code, *addr2;
 	struct ieee80211_hdr *ieee_hdr = (void *)payload;
 
+	if (len < sizeof(*ieee_hdr))
+		return -1;
+
 	stype = (le16_to_cpu(ieee_hdr->frame_control) & IEEE80211_FCTL_STYPE);
 
 	switch (stype) {
 	case IEEE80211_STYPE_ACTION:
+		if (len < sizeof(*ieee_hdr) + 1)
+			return -1;
+
 		category = *(payload + sizeof(struct ieee80211_hdr));
 		switch (category) {
 		case WLAN_CATEGORY_PUBLIC:
+			if (len < sizeof(*ieee_hdr) + 2)
+				return -1;
+
 			action_code = *(payload + sizeof(struct ieee80211_hdr)
 					+ 1);
 			if (action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) {
-- 
2.50.1 (Apple Git-155)