wifi: mwifiex: Fix OOB and integer underflow when rx packets
Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet not out-of-bounds access the skb->data buffer. Fixes: 2dbaf751 ("mwifiex: report received management frames to cfg80211") Signed-off-by:Polaris Pi <pinkperfect2021@gmail.com> Reviewed-by:
Matthew Wang <matthewmwang@chromium.org> Reviewed-by:
Brian Norris <briannorris@chromium.org> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com
Showing
- drivers/net/wireless/marvell/mwifiex/sta_rx.c 10 additions, 1 deletiondrivers/net/wireless/marvell/mwifiex/sta_rx.c
- drivers/net/wireless/marvell/mwifiex/uap_txrx.c 19 additions, 0 deletionsdrivers/net/wireless/marvell/mwifiex/uap_txrx.c
- drivers/net/wireless/marvell/mwifiex/util.c 7 additions, 3 deletionsdrivers/net/wireless/marvell/mwifiex/util.c
Loading