From: Johannes Berg Date: Thu, 23 May 2024 10:05:33 +0000 (+0200) Subject: wifi: cfg80211: validate HE operation element parsing X-Git-Tag: v6.10-rc3~27^2~22^2~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4dc3a3893dae5a7f73e5809273aca0f1f3548d55;p=thirdparty%2Flinux.git wifi: cfg80211: validate HE operation element parsing Validate that the HE operation element has the correct length before parsing it. Cc: stable@vger.kernel.org Fixes: 645f3d85129d ("wifi: cfg80211: handle UHB AP and STA power type") Reviewed-by: Miriam Rachel Korenblit Link: https://msgid.link/20240523120533.677025eb4a92.I44c091029ef113c294e8fe8b9bf871bf5dbeeb27@changeid Signed-off-by: Johannes Berg --- diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 127853877a0ad..8daed8232b054 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2128,7 +2128,8 @@ static bool cfg80211_6ghz_power_type_valid(const u8 *ie, size_t ielen, struct ieee80211_he_operation *he_oper; tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ielen); - if (tmp && tmp->datalen >= sizeof(*he_oper) + 1) { + if (tmp && tmp->datalen >= sizeof(*he_oper) + 1 && + tmp->datalen >= ieee80211_he_oper_size(tmp->data + 1)) { const struct ieee80211_he_6ghz_oper *he_6ghz_oper; he_oper = (void *)&tmp->data[1];