wifi: mwifiex: Fix OOB and integer underflow when rx packets
authorPolaris Pi <pinkperfect2021@gmail.com>
Sun, 23 Jul 2023 07:07:41 +0000 (07:07 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 13 Sep 2023 07:42:31 +0000 (09:42 +0200)
commit3975e21d4d01efaf0296ded40d11c06589c49245
treed8be5d7d29f2e2c880dfd7f7f18baf55391467e3
parent49b6db89ab287f443e6fd9aa178780d76c8f1f60
wifi: mwifiex: Fix OOB and integer underflow when rx packets

[ Upstream commit 11958528161731c58e105b501ed60b83a91ea941 ]

Make sure mwifiex_process_mgmt_packet,
mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,
mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet
not out-of-bounds access the skb->data buffer.

Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80211")
Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
Reviewed-by: Matthew Wang <matthewmwang@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/marvell/mwifiex/sta_rx.c
drivers/net/wireless/marvell/mwifiex/uap_txrx.c
drivers/net/wireless/marvell/mwifiex/util.c