wifi: mwifiex: Fix missed return in oob checks failed path

roxanan1996 · roxanan1996 · commit dac40909974a · 2025-12-18T10:02:33.000+01:00
jira VULN-154521 cve-bf CVE-2023-53226 commit-author Polaris Pi <pinkperfect2021@gmail.com> commit 2785851 Add missed return in mwifiex_uap_queue_bridged_pkt() and mwifiex_process_rx_packet(). Fixes: 1195852 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com> Reported-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com (cherry picked from commit 2785851) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
@@ -104,6 +104,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
 			    skb->len, rx_pkt_off);
 		priv->stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
+		return -1;
 	}
 
 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -122,6 +122,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
 			    skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
 		priv->stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
+		return;
 	}
 
 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,

Original file line number	Diff line number	Diff line change
`@@ -104,6 +104,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,`
`104`	`104`	`skb->len, rx_pkt_off);`
`105`	`105`	`priv->stats.rx_dropped++;`
`106`	`106`	`dev_kfree_skb_any(skb);`
	`107`	`+ return -1;`
`107`	`108`	`}`
`108`	`109`
`109`	`110`	`if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,`
Original file line number	Diff line number	Diff line change
`@@ -122,6 +122,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,`
`122`	`122`	`skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));`
`123`	`123`	`priv->stats.rx_dropped++;`
`124`	`124`	`dev_kfree_skb_any(skb);`
	`125`	`+ return;`
`125`	`126`	`}`
`126`	`127`
`127`	`128`	`if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,`