Re: [PATCH] wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
Arend van Spriel <[email protected]> Mon, 6 Jul 2026 21:06:11 +0200
| Newsgroups | dev.linux.lists.brcm80211,org.kernel.vger.linux-kernel,org.kernel.vger.linux-wireless,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 27 Jun 2026 21:13:13 +0800, Maoyi Xie wrote:
> brcmf_notify_auth_frame_rx() takes the frame length from the firmware
> event and copies the frame body with the management header offset
> subtracted:
[...]
> Reject frames shorter than the management header offset before the copy.
>
> Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode")
> Link: https://lore.kernel.org/r/[email protected]
> Cc: [email protected]
> Co-developed-by: Kaixuan Li <[email protected]>
> Signed-off-by: Kaixuan Li <[email protected]>
> Signed-off-by: Maoyi Xie <[email protected]>
> ---
> .../broadcom/brcm80211/brcmfmac/cyw/core.c | 6 ++++++
> 1 file changed, 6 insertions(+)
Nit: the Link: tag in the commit message is normally added by the
maintainer at apply time, not by the submitter. Please drop it.
Acked-by: Arend van Spriel <[email protected]>
Regards,
Arend