MGT path guarantees m_pkthdr.len >= 24 but never m_pullup's; sta_recv_mgmt parses off m_len — chained management frames yield stale-byte reads past the first mbuf (sta.c mirror of DF-0348)
Summary
sta_input's MGT dispatch validates m_pkthdr.len >= 24 but performs no m_pullup, then hands the mbuf to sta_recv_mgmt which computes efrm = mtod + m_len. The per-subtype walks are self-bounding against efrm (a chained frame with m_len < 24 makes efrm-frm negative and every VERIFY_LENGTH discards - safe by construction), but the direct header field reads are not: wh->i_addr2 (offsets 10-15) and wh->i_addr1 (4-9) read past the first mbuf's data when a driver delivers a chained management frame with m_len < 16/10. Impact is decisions/statistics on stale mbuf bytes; no in-tree driver delivers chained mgmt frames - defense-in-depth (same class as DF-0348 for hostap.c). Info hardening. Fix: pull the header contiguous at dispatch, as the DATA path already does. [VERIFIED pass2: MGT dispatch checks only pkthdr.len no m_pullup; no driver delivers chained mgmt here; m_pullup fix compiled]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3375 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 247 B | ↓ raw | |
| fix.diff | — | 747 B | view raw | |
| manifest.json | — | 384 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-3375 evidence pack
What
sta_recv_mgmt parses off m_len with no m_pullup after the MGT length check
Verdict
status=not_reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
not_testablefix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a - no chained-mgmt driver on this guest
Verified recommended fix
m_pullup(sizeof(struct ieee80211_frame)) before iv_recv_mgmt dispatch
Verdict
Line-accurate confirmation; runtime demonstration not possible on this guest (no in-tree driver delivers chained management frames; QEMU has no 802.11 radio). sta_inputs MGT dispatch validates only m_pkthdr.len >= sizeof(frame) (ieee80211_sta.c:878) and calls vap->iv_recv_mgmt at :916 without m_pullup; sta_recv_mgmt computes efrm = mtod + m_len, so a driver delivering a chained frame with m_len < 24 makes efrm-frm negative (self-bounding VERIFY_LENGTHs discard safely) but the direct wh->i_addr1/i_addr2 reads at offsets 4-15 can read past the first mbuf. Mirror of DF-0348 (hostap). Fix pulls up sizeof(ieee80211_frame) before dispatch; compiled in the F40FIX build.
No comments yet.