]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: mac80211: validate deauth frame length before reason access
authorZhao Li <enderaoelyther@gmail.com>
Fri, 12 Jun 2026 18:50:45 +0000 (02:50 +0800)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 6 Jul 2026 12:11:11 +0000 (14:11 +0200)
commit4a360c6e18dfa9d70006c7247a6a8cc8dfe0d60f
tree6914d2df9741d87c5b10f92a7057cd91aa9de220
parent035ed430ce6a2c35b01e211844a9f0a7643e57a4
wifi: mac80211: validate deauth frame length before reason access

ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking
that the fixed field is actually present in the received frame.

Validate the deauth frame length first and only then read the reason
code.

Assisted-by: Codex:gpt-5.5
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260612185042.66260-6-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/mlme.c