Pengpeng Hou 13ff543e0b wifi: libertas: reject short monitor TX frames ...

In monitor mode, lbs_hard_start_xmit() casts skb->data to a
radiotap TX header, skips that header, and then copies the 802.11
destination address from offset 4 in the remaining frame.  The
generic length check only rejects zero-length and oversized skbs, so
a short monitor frame can be read past the end of the skb data.

Require enough bytes for the radiotap TX header and the destination
address field before using the monitor-mode header layout.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704011140.37639-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

2026-07-06 14:11:08 +02:00

..

libertas

wifi: libertas: reject short monitor TX frames

2026-07-06 14:11:08 +02:00

libertas_tf

wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()

2026-07-06 14:11:07 +02:00

mwifiex

wifi: mwifiex: fix permanently busy scans after multiple roam iterations

2026-07-06 10:09:01 +02:00

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

Makefile

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00

mwl8k.c

wifi: move action code from per-type frame structs

2026-03-06 10:36:26 +01:00