wifi: mac80211_hwsim: drop short frames
authorJohannes Berg <johannes.berg@intel.com>
Tue, 15 Aug 2023 19:28:01 +0000 (21:28 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 23 Sep 2023 09:11:03 +0000 (11:11 +0200)
commitb9a175e3b250b0dc6e152988040aa5014e98e61e
treefc79ea3c0a838174ba215e5f8017b3857330c8fa
parent7e1cda5cf07f848e6b50b4e5e7761ffbce905a3d
wifi: mac80211_hwsim: drop short frames

[ Upstream commit fba360a047d5eeeb9d4b7c3a9b1c8308980ce9a6 ]

While technically some control frames like ACK are shorter and
end after Address 1, such frames shouldn't be forwarded through
wmediumd or similar userspace, so require the full 3-address
header to avoid accessing invalid memory if shorter frames are
passed in.

Reported-by: syzbot+b2645b5bf1512b81fa22@syzkaller.appspotmail.com
Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/mac80211_hwsim.c