diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2026-05-29 10:25:00 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-06-03 14:11:57 +0200 |
| commit | e48223525a54d3a3182d2d9a497dca022b942b4d (patch) | |
| tree | 4637b97c147d3447c47a5b1557242929996c5b60 /net/wireless | |
| parent | c93db0bfff162b01fae17a674ff2bd3ae8ec37d3 (diff) | |
| download | linux-next-e48223525a54d3a3182d2d9a497dca022b942b4d.tar.gz linux-next-e48223525a54d3a3182d2d9a497dca022b942b4d.zip | |
wifi: cfg80211: harden cfg80211_defragment_element()
A previous commit changed mac80211 to no longer make wrong
calls to cfg80211_defragment_element() with the element
pointing outside of the buffer. Additionally, harden this
function itself against that and always return -EINVAL in
case the element isn't inside the source buffer.
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Link: https://patch.msgid.link/20260529102644.198945754054.I5ae8fdebf9008abc6e15d0b0f10c3a7b73d02eab@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/scan.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 358cbc9e43d8..17f0032844ab 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -5,7 +5,7 @@ * Copyright 2008 Johannes Berg <johannes@sipsolutions.net> * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright 2016 Intel Deutschland GmbH - * Copyright (C) 2018-2025 Intel Corporation + * Copyright (C) 2018-2026 Intel Corporation */ #include <linux/kernel.h> #include <linux/slab.h> @@ -2603,7 +2603,9 @@ ssize_t cfg80211_defragment_element(const struct element *elem, const u8 *ies, ssize_t copied; u8 elem_datalen; - if (!elem) + if (!elem || (const u8 *)elem < ies || + (const u8 *)elem + sizeof(*elem) > ies + ieslen || + (const u8 *)elem + sizeof(*elem) + elem->datalen > ies + ieslen) return -EINVAL; /* elem might be invalid after the memmove */ |