wifi: mac80211: check S1G action frame size

jira VULN-154634
cve CVE-2023-53257
commit-author Johannes Berg <[email protected]>
commit 19e4a47

Before checking the action code, check that it even
exists in the frame.

	Reported-by: [email protected]
	Signed-off-by: Johannes Berg <[email protected]>
(cherry picked from commit 19e4a47)
	Signed-off-by: Jonathan Maple <[email protected]>

Author: PlaidCat

net/mac80211/rx.c

@@ -3555,6 +3555,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 			break;
 		goto queue;
 	case WLAN_CATEGORY_S1G:
+		if (len < offsetofend(typeof(*mgmt),
+				      u.action.u.s1g.action_code))
+			break;
+
 		switch (mgmt->u.action.u.s1g.action_code) {
 		case WLAN_S1G_TWT_SETUP:
 		case WLAN_S1G_TWT_TEARDOWN: