Re: [PATCH] mac80211: prevent out of bounds access in ieee80211_rx_h_action()

[Johannes Berg <johannes@xxxxxxxxxxxxxxxx>]

On Wed, 2022-01-19 at 15:59 +0300, Dan Carpenter wrote:
> Smatch complains that status->band comes from the skb->data
> 

Hmm. How does it come to that conclusion? It's not really true? It comes
from skb->cb, and the driver should fill it. Also, we have:

void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
                       struct sk_buff *skb, struct list_head *list)
{
...
        if (WARN_ON(status->band >= NUM_NL80211_BANDS))
                goto drop;


so I really don't think this patch is needed?

johannes