wifi: mwifiex: Fix OOB and integer underflow when rx packets
authorPolaris Pi <pinkperfect2021@gmail.com>
Sun, 23 Jul 2023 07:07:41 +0000 (07:07 +0000)
committerKalle Valo <kvalo@kernel.org>
Tue, 1 Aug 2023 14:47:27 +0000 (17:47 +0300)
commit11958528161731c58e105b501ed60b83a91ea941
treed774bb005a3e9d1fc95a042afffe2d705ee217ad
parent646462f860f12a2e24e6b2ed856cf6645c02397d
wifi: mwifiex: Fix OOB and integer underflow when rx packets

Make sure mwifiex_process_mgmt_packet,
mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,
mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet
not out-of-bounds access the skb->data buffer.

Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80211")
Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
Reviewed-by: Matthew Wang <matthewmwang@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com
drivers/net/wireless/marvell/mwifiex/sta_rx.c
drivers/net/wireless/marvell/mwifiex/uap_txrx.c
drivers/net/wireless/marvell/mwifiex/util.c