On Wed, 16 Apr 2025 07:49:03 +0530, Nithyanantham Paramasivam wrote:
> In the WBM error path, while processing TKIP MIC errors, MSDU length
> is fetched from the hal_rx_desc's msdu_end. This MSDU length is
> directly passed to skb_put without validation. In stress test
> scenarios, the WBM error ring may receive invalid descriptors, which
> could lead to an invalid MSDU length.
>
> To fix this, add a check to drop the skb when the calculated MSDU
> length is greater than the skb size.
>
> [...]
Applied, thanks!
[1/1] wifi: ath12k: Add MSDU length validation for tkip mic error error
commit: 763216fe6c5df95d122c71ef34c342427c987820
Best regards,
--
Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx>
