wifi: mwifiex: Fix missed return in oob checks failed path

shreeya-patel98 · shreeya-patel98 · commit baba026a6cab · 2025-11-14T11:38:30.000Z
jira VULN-154525 cve-bf CVE-2023-53226 commit-author Polaris Pi <pinkperfect2021@gmail.com> commit 2785851 Add missed return in mwifiex_uap_queue_bridged_pkt() and mwifiex_process_rx_packet(). Fixes: 1195852 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com> Reported-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com (cherry picked from commit 2785851) Signed-off-by: Shreeya Patel <spatel@ciq.com>
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
@@ -93,6 +93,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
 			    skb->len, rx_pkt_off);
 		priv->stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
+		return -1;
 	}
 
 	if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len &&
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -110,6 +110,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
 			    skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
 		priv->stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
+		return;
 	}
 
 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,

Original file line number	Diff line number	Diff line change
`@@ -93,6 +93,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,`
`93`	`93`	`skb->len, rx_pkt_off);`
`94`	`94`	`priv->stats.rx_dropped++;`
`95`	`95`	`dev_kfree_skb_any(skb);`
	`96`	`+ return -1;`
`96`	`97`	`}`
`97`	`98`
`98`	`99`	`if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len &&`
Original file line number	Diff line number	Diff line change
`@@ -110,6 +110,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,`
`110`	`110`	`skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));`
`111`	`111`	`priv->stats.rx_dropped++;`
`112`	`112`	`dev_kfree_skb_any(skb);`
	`113`	`+ return;`
`113`	`114`	`}`
`114`	`115`
`115`	`116`	`if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,`