[PATCH] wifi: cw1200: validate RX header before use
From: Pengpeng Hou <hidden>
Date: 2026-08-30 13:57:05
Also in:
lkml
Subsystem:
cw1200 wlan driver, the rest · Maintainer:
Linus Torvalds
cw1200_rx_cb() interprets frame_control and management-frame fields before
reaching its existing minimum IEEE 802.11 header check. A short firmware
frame can therefore be read before it is rejected.
Move the existing length check ahead of the first header consumer.
Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Pengpeng Hou <redacted>
---
drivers/net/wireless/st/cw1200/txrx.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/st/cw1200/txrx.c b/drivers/net/wireless/st/cw1200/txrx.c
index 084d52b11f5b0..e5435595a78f0 100644
--- a/drivers/net/wireless/st/cw1200/txrx.c
+++ b/drivers/net/wireless/st/cw1200/txrx.c@@ -1018,6 +1018,11 @@ void cw1200_rx_cb(struct cw1200_common *priv, /* STA is stopped. */ goto drop; } + if (skb->len < sizeof(struct ieee80211_pspoll)) { + wiphy_warn(priv->hw->wiphy, + "Malformed SDU rx'ed. Size is lesser than IEEE header.\n"); + goto drop; + } if (link_id && link_id <= CW1200_MAX_STA_IN_AP_MODE) { entry = &priv->link_id_db[link_id - 1];
@@ -1062,11 +1067,6 @@ void cw1200_rx_cb(struct cw1200_common *priv, } } - if (skb->len < sizeof(struct ieee80211_pspoll)) { - wiphy_warn(priv->hw->wiphy, "Malformed SDU rx'ed. Size is lesser than IEEE header.\n"); - goto drop; - } - if (ieee80211_is_pspoll(frame->frame_control)) if (cw1200_handle_pspoll(priv, skb)) goto drop;
base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72 -- 2.50.1