From d4b21975f47b13b41c2f2b29f0a2823ce40ea97a Mon Sep 17 00:00:00 2001 From: Tianchu Chen Date: Thu, 24 Sep 2026 09:03:28 +0000 Subject: [PATCH] wifi: cw1200: fix link_id_db OOB access via device-controlled link ID cw1200_rx_cb() stores the link ID from the device-supplied WSM header (a 4-bit field, range 0-15) into priv->action_linkid for P2P public action frames without an upper bound check. The work handler cw1200_link_id_reset() then uses it to index link_id_db[], which has only CW1200_MAX_STA_IN_AP_MODE (5) entries, so a device reporting a link ID of 6-15 makes the driver read and write cw1200_common fields past the array (a status copy and a constant store onto adjacent work/lock/timer fields), corrupting driver state. The first link ID check in the same function (used for timestamp tracking) already validates against CW1200_MAX_STA_IN_AP_MODE and degrades out-of-range IDs to untracked handling, so out-of-range link IDs on the RX path are anticipated; the P2P remap branch was missed. Add the same bound to the remap branch. This is expected to keep driver behavior unchanged in most cases: the driver itself only assigns link IDs 1..5, and a P2P public action frame carrying any other ID now degrades to the same untracked handling the first branch already applies, instead of corrupting memory. Discovered by Atuin - Automated Vulnerability Discovery Engine. Assisted-by: LLM Signed-off-by: Tianchu Chen Link: https://patch.msgid.link/969ee752d023e7431481605c320fa0636cc6f20c@linux.dev Signed-off-by: Johannes Berg --- drivers/net/wireless/st/cw1200/txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/st/cw1200/txrx.c b/drivers/net/wireless/st/cw1200/txrx.c index 084d52b11f5b..0e041be88bba 100644 --- a/drivers/net/wireless/st/cw1200/txrx.c +++ b/drivers/net/wireless/st/cw1200/txrx.c @@ -1036,7 +1036,7 @@ void cw1200_rx_cb(struct cw1200_common *priv, schedule_work(&priv->linkid_reset_work); } - if (link_id && p2p && + if (link_id && link_id <= CW1200_MAX_STA_IN_AP_MODE && p2p && ieee80211_is_action(frame->frame_control) && (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC)) { /* Link ID already exists for the ACTION frame.