diff options
| author | Ping-Ke Shih <pkshih@realtek.com> | 2026-04-14 14:22:29 +0800 |
|---|---|---|
| committer | Ping-Ke Shih <pkshih@realtek.com> | 2026-04-29 11:01:06 +0800 |
| commit | 043f09bb78ddb98dd5d587bf8fe4836daeb3a735 (patch) | |
| tree | 422e474f0a6fe0b565099328e8576144d4b93b2e | |
| parent | c9f10419c38ed619fadad7b8d72f05fca5b4ade8 (diff) | |
wifi: rtlwifi: validate action frame size before using in _rtl_pci_tx_isr()
Since TX action frames might be malformed, validate the size before using.
Tested on RTL8723BE.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260414062229.21047-4-pkshih@realtek.com
| -rw-r--r-- | drivers/net/wireless/realtek/rtlwifi/pci.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c index 9cc0a871ea3c..73018a0498b4 100644 --- a/drivers/net/wireless/realtek/rtlwifi/pci.c +++ b/drivers/net/wireless/realtek/rtlwifi/pci.c @@ -505,9 +505,10 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio) } } if (ieee80211_is_action(fc)) { - struct ieee80211_mgmt *action_frame = - (struct ieee80211_mgmt *)skb->data; - if (action_frame->u.action.action_code == + struct ieee80211_mgmt *action_frame = (void *)skb->data; + + if (skb->len >= IEEE80211_MIN_ACTION_SIZE(action_code) && + action_frame->u.action.action_code == WLAN_HT_ACTION_SMPS) { dev_kfree_skb(skb); goto tx_status_ok; |