wifi: mwifiex: Fix missed return in oob checks failed path

pinkperfect · Kalle Valo · commit 2785851c627f · 2023-08-21T18:57:39.000+03:00
Add missed return in mwifiex_uap_queue_bridged_pkt() and mwifiex_process_rx_packet(). Fixes: 1195852 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com> Reported-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
@@ -92,6 +92,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
 			    skb->len, rx_pkt_off);
 		priv->stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
+		return -1;
 	}
 
 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -110,6 +110,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
 			    skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
 		priv->stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
+		return;
 	}
 
 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,

Original file line number	Diff line number	Diff line change
`@@ -92,6 +92,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,`
`92`	`92`	`skb->len, rx_pkt_off);`
`93`	`93`	`priv->stats.rx_dropped++;`
`94`	`94`	`dev_kfree_skb_any(skb);`
	`95`	`+ return -1;`
`95`	`96`	`}`
`96`	`97`
`97`	`98`	`if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,`
Original file line number	Diff line number	Diff line change
`@@ -110,6 +110,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,`
`110`	`110`	`skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));`
`111`	`111`	`priv->stats.rx_dropped++;`
`112`	`112`	`dev_kfree_skb_any(skb);`
	`113`	`+ return;`
`113`	`114`	`}`
`114`	`115`
`115`	`116`	`if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,`