]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: ieee80211: validate MLE common info length
authorZhao Li <enderaoelyther@gmail.com>
Thu, 11 Jun 2026 17:35:07 +0000 (01:35 +0800)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 6 Jul 2026 12:11:09 +0000 (14:11 +0200)
commit293baeae9b2434a3e432629d7720b5603db2d77e
tree171221e9aa5163b3f12d21350778a5db2562bf96
parent4e5a4641e7b4763656336b7891d01359aaf363cd
wifi: ieee80211: validate MLE common info length

ieee80211_mle_common_size() uses the first common-info octet as the
common information length for all known MLE types. However,
ieee80211_mle_size_ok() only validates that octet for Basic, Probe
Request, and TDLS MLEs.

Reconfiguration MLEs also skipped the length octet when calculating the
minimum common size, and Priority Access MLEs skipped validation of the
advertised common information length.

Account for the Reconfiguration common-info length octet and validate
the advertised common information length for all known MLE types. Keep
unknown-type handling unchanged.

Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260611173506.36838-2-enderaoelyther@gmail.com
[remove now misleading comment]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
include/linux/ieee80211-eht.h