wifi: mwifiex: Fix missed return in oob checks failed path

PlaidCat · PlaidCat · commit 9eb6fba48518 · 2025-12-16T16:48:50.000-05:00
jira VULN-154524 cve-bf CVE-2023-53226 commit-author Polaris Pi <pinkperfect2021@gmail.com> commit 2785851 Add missed return in mwifiex_uap_queue_bridged_pkt() and mwifiex_process_rx_packet(). Fixes: 1195852 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com> Reported-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com (cherry picked from commit 2785851) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
@@ -105,6 +105,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
 			    skb->len, rx_pkt_off);
 		priv->stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
+		return -1;
 	}
 
 	if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len &&
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -122,6 +122,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
 			    skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
 		priv->stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
+		return;
 	}
 
 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,

Original file line number	Diff line number	Diff line change
`@@ -105,6 +105,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,`
`105`	`105`	`skb->len, rx_pkt_off);`
`106`	`106`	`priv->stats.rx_dropped++;`
`107`	`107`	`dev_kfree_skb_any(skb);`
	`108`	`+ return -1;`
`108`	`109`	`}`
`109`	`110`
`110`	`111`	`if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len &&`
Original file line number	Diff line number	Diff line change
`@@ -122,6 +122,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,`
`122`	`122`	`skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));`
`123`	`123`	`priv->stats.rx_dropped++;`
`124`	`124`	`dev_kfree_skb_any(skb);`
	`125`	`+ return;`
`125`	`126`	`}`
`126`	`127`
`127`	`128`	`if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,`