]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
projects / thirdparty / kernel / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2676932) | patch
wifi: rtlwifi: validate action frame size in rtl_action_proc()
authorPing-Ke Shih <pkshih@realtek.com>
Tue, 14 Apr 2026 06:22:28 +0000 (14:22 +0800)
committerPing-Ke Shih <pkshih@realtek.com>
Wed, 29 Apr 2026 03:00:55 +0000 (11:00 +0800)
commitc9f10419c38ed619fadad7b8d72f05fca5b4ade8
treebc5b4a8bedf06db8a44bcd9aede73605874c4caetree | snapshot
parent26769329c40a4d7f443f22f526de19eeedea67a2commit | diff
wifi: rtlwifi: validate action frame size in rtl_action_proc()

Since action frames might be malformed from RX or injected TX, validate
the size before using.

More, use struct ieee80211_mgmt to access fields of action frames instead
of counting barely.

Tested with ping on RTL8723BE. The add BA request action frames of TX/RX
can be handled properly.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260414062229.21047-3-pkshih@realtek.com
drivers/net/wireless/realtek/rtlwifi/base.c diff | blob | blame | history
A mirror of Linus' kernel repository