wifi: mac80211: check S1G action frame size

Before checking the action code, check that it even
exists in the frame.

Reported-by: [email protected]
Signed-off-by: Johannes Berg <[email protected]>

Author: jmberg-intel

net/mac80211/rx.c

@@ -3732,6 +3732,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 			break;
 		goto queue;
 	case WLAN_CATEGORY_S1G:
+		if (len < offsetofend(typeof(*mgmt),
+				      u.action.u.s1g.action_code))
+			break;
+
 		switch (mgmt->u.action.u.s1g.action_code) {
 		case WLAN_S1G_TWT_SETUP:
 		case WLAN_S1G_TWT_TEARDOWN: