wifi: mac80211: check S1G action frame size

jira VULN-154634
cve CVE-2023-53257
commit-author Johannes Berg <johannes.berg@intel.com>
commit 19e4a47

Before checking the action code, check that it even
exists in the frame.

	Reported-by: syzbot+be9c824e6f269d608288@syzkaller.appspotmail.com
	Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 19e4a47)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

Author: PlaidCat

net/mac80211/rx.c

@@ -3555,6 +3555,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 			break;
 		goto queue;
 	case WLAN_CATEGORY_S1G:
+		if (len < offsetofend(typeof(*mgmt),
+				      u.action.u.s1g.action_code))
+			break;
+
 		switch (mgmt->u.action.u.s1g.action_code) {
 		case WLAN_S1G_TWT_SETUP:
 		case WLAN_S1G_TWT_TEARDOWN: