MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-19 07:39:54 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

UPSTREAM: wifi: cfg80211: validate HE operation element parsing

Browse Source 
Validate that the HE operation element has the correct
length before parsing it.

Bug: 254441685
Cc: stable@vger.kernel.org
Fixes: 645f3d8512 ("wifi: cfg80211: handle UHB AP and STA power type")
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240523120533.677025eb4a92.I44c091029ef113c294e8fe8b9bf871bf5dbeeb27@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 4dc3a3893d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ifaa6716945353231510317dbb5282954ae6bd452
This commit is contained in:
Johannes Berg 2024-05-23 12:05:33 +02:00 committed by Lee Jones
parent af3fbe448f
commit 00079e2bce
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/wireless/scan.c
View File

@ -2148,7 +2148,8 @@ static bool cfg80211_6ghz_power_type_valid(const u8 *ie, size_t ielen,
struct ieee80211_he_operation *he_oper;
tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ielen);
if (tmp && tmp->datalen >= sizeof(*he_oper) + 1) {
if (tmp && tmp->datalen >= sizeof(*he_oper) + 1 &&
tmp->datalen >= ieee80211_he_oper_size(tmp->data + 1)) {
const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
he_oper = (void *)&tmp->data[1];