[PATCH v4] wifi: mwifiex: validate action frame fixed fields

[Zhao Li]

mwifiex_process_mgmt_packet() accepts an rx_pkt_length as small as a
four-address struct ieee80211_hdr plus the two-byte firmware length prefix.
After stripping the prefix, mwifiex_parse_mgmt_packet() can receive a
frame equal to sizeof(struct ieee80211_hdr).

For action frames, the parser reads the category byte immediately after
that header and, for a public action frame, reads the following action
code byte without verifying that either field is present. A truncated frame
can therefore make the parser consume up to two bytes past the
firmware-declared frame length. If those bytes look like a TDLS discovery
response, the malformed frame can spuriously update peer signal state.

Require the category and public action-code fields before reading them.
Use sizeof(*ieee_hdr) so the checks and field accesses directly match the
firmware four-address layout being parsed before address4 is removed.

Suggested-by: Johannes Berg <johannes@xxxxxxxxxxxxxxxx>
Suggested-by: Brian Norris <briannorris@xxxxxxxxxxxx>
Fixes: 72e5aa8d2a6d ("mwifiex: support for parsing TDLS discovery frames")
Cc: stable@xxxxxxxxxxxxxxx
Link: https://lore.kernel.org/all/66f148d83eb9f0970b9abbccc85d1b61244e54ad.camel@xxxxxxxxxxxxxxxx/
Link: https://lore.kernel.org/all/20260708195911.84365-8-enderaoelyther@xxxxxxxxx/
Link: https://lore.kernel.org/all/20260723011013.76968-1-enderaoelyther@xxxxxxxxx/
Link: https://lore.kernel.org/all/20260723202257.688-1-enderaoelyther@xxxxxxxxx/
Link: https://lore.kernel.org/all/anuWyiPQja6_5vly@xxxxxxxxxx/
Assisted-by: Codex:gpt-5
Assisted-by: Kimi:K3
Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
---
Changes in v4:
- Match the actual four-address parser layout with sizeof(*ieee_hdr) + 1
  and sizeof(*ieee_hdr) + 2, as suggested by Brian.
- Use sizeof(*ieee_hdr) consistently for the corresponding field reads.
- Audit the firmware-length containment concern: both callers reject an
  rx_pkt_offset plus rx_pkt_length beyond skb->len before entering this
  helper, so no redundant check is added here.
- Describe the out-of-frame read and possible TDLS signal-state update
  precisely.

Changes in v3:
- Drop the redundant parser-local header check; the caller already
  guarantees the complete four-address header after removing the two-byte
  firmware prefix.

Changes in v2:
- Express the action-field sizes with IEEE80211_MIN_ACTION_SIZE(),
  accounting for the firmware four-address layout.
---
 drivers/net/wireless/marvell/mwifiex/util.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
index 7d3631d21223..71305efb77ac 100644
--- a/drivers/net/wireless/marvell/mwifiex/util.c
+++ b/drivers/net/wireless/marvell/mwifiex/util.c
@@ -317,10 +317,16 @@ mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len,
 
 	switch (stype) {
 	case IEEE80211_STYPE_ACTION:
-		category = *(payload + sizeof(struct ieee80211_hdr));
+		if (len < sizeof(*ieee_hdr) + 1)
+			return -1;
+
+		category = *(payload + sizeof(*ieee_hdr));
 		switch (category) {
 		case WLAN_CATEGORY_PUBLIC:
-			action_code = *(payload + sizeof(struct ieee80211_hdr)
+			if (len < sizeof(*ieee_hdr) + 2)
+				return -1;
+
+			action_code = *(payload + sizeof(*ieee_hdr)
 					+ 1);
 			if (action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) {
 				addr2 = ieee_hdr->addr2;
-- 
2.50.1 (Apple Git-155)