diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2026-04-15 14:42:12 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-04-28 09:29:02 +0200 |
| commit | 8b9a100e1a76c52988b31099b349fd95a58c8768 (patch) | |
| tree | bfe3e19db763a59ff9546e46d8d24e284f760886 /net/wireless | |
| parent | e12e20650f64d109971f27a30260f1012b7d26fe (diff) | |
| download | linux-next-8b9a100e1a76c52988b31099b349fd95a58c8768.tar.gz linux-next-8b9a100e1a76c52988b31099b349fd95a58c8768.zip | |
wifi: nl80211: reject beacons with bad HE operation
The HE operation element not only needs to be longer than
the fixed part, but also have an appropriate size for the
variable part inside of it. Check this.
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260415144514.6217f5974fb5.Iff7ff6bcb159584e756d0f825c65860cdd53c6ea@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/nl80211.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index a4d9b4068506..9892cbc182b9 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -6673,8 +6673,12 @@ static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) if (cap && cap->datalen >= sizeof(*params->he_cap) + 1) params->he_cap = (void *)(cap->data + 1); cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len); - if (cap && cap->datalen >= sizeof(*params->he_oper) + 1) + if (cap && cap->datalen >= sizeof(*params->he_oper) + 1) { params->he_oper = (void *)(cap->data + 1); + /* takes extension ID into account */ + if (cap->datalen < ieee80211_he_oper_size((void *)params->he_oper)) + return -EINVAL; + } cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len); if (cap) { if (!cap->datalen) |