wifi: mac80211: validate deauth frame length before reason access

ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking
that the fixed field is actually present in the received frame.

Validate the deauth frame length first and only then read the reason
code.

Assisted-by: Codex:gpt-5.5
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260612185042.66260-6-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 86c90b504cfd7aff849b65a43dbe2f1a35699017..fa773f3b0541ace523162a65579c9cd284d4025d 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -5641,13 +5641,15 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt, size_t len)
 {
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-       u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
+       u16 reason_code;
 
        lockdep_assert_wiphy(sdata->local->hw.wiphy);
 
-       if (len < 24 + 2)
+       if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code))
                return;
 
+       reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
+
        if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
                ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
                return;