linux-kernel - Re: [PATCH] wifi: mwifiex: Fix use after free in mwifiex_11n_dispatch_amsdu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e4f3a3d9775d975f33c307bb5b01b26d3ad9daff.camel@sipsolutions.net>
Date: Thu, 08 Jan 2026 22:01:01 +0100
From: Johannes Berg <johannes@...solutions.net>
To: Dan Carpenter <dan.carpenter@...aro.org>, Amitkumar Karwar
	 <akarwar@...vell.com>
Cc: Brian Norris <briannorris@...omium.org>, Francesco Dolcini
	 <francesco@...cini.it>, Kalle Valo <kvalo@...nel.org>, Cathy Luo
	 <cluo@...vell.com>, linux-wireless@...r.kernel.org, 
	linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] wifi: mwifiex: Fix use after free in
 mwifiex_11n_dispatch_amsdu_pkt()

On Thu, 2026-01-08 at 22:57 +0300, Dan Carpenter wrote:
> @@ -44,7 +45,7 @@ static int mwifiex_11n_dispatch_amsdu_pkt(struct mwifiex_private *priv,
>  			    ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {
>  				mwifiex_process_tdls_action_frame(priv,
>  								  (u8 *)rx_hdr,
> -								  skb->len);
> +								  skb_len);

I'm 99% sure that should be rx_skb->len at this point, it can't want to
handle a single A-MSDU encapsulated action as if it was as long as the
entire A-MSDU that held it, that'd likely crash (too), especially if it
wasn't the first frame in it.

johannes