wifi: ieee80211: validate MLE common info length

ieee80211_mle_common_size() uses the first common-info octet as the
common information length for all known MLE types. However,
ieee80211_mle_size_ok() only validates that octet for Basic, Probe
Request, and TDLS MLEs.

Reconfiguration MLEs also skipped the length octet when calculating the
minimum common size, and Priority Access MLEs skipped validation of the
advertised common information length.

Account for the Reconfiguration common-info length octet and validate
the advertised common information length for all known MLE types. Keep
unknown-type handling unchanged.

Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260611173506.36838-2-enderaoelyther@gmail.com
[remove now misleading comment]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h
index 18f9c662cf4cbe2cc90542e83b7d6ebe7e7bb06f..c109722b1969a95a21f4a96f7cffecd987a14d33 100644 (file)
--- a/include/linux/ieee80211-eht.h
+++ b/include/linux/ieee80211-eht.h
@@ -857,7 +857,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
        const struct ieee80211_multi_link_elem *mle = (const void *)data;
        u8 fixed = sizeof(*mle);
        u8 common = 0;
-       bool check_common_len = false;
+       u8 common_len;
        u16 control;
 
        if (!data || len < fixed)
@@ -868,7 +868,6 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
        switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) {
        case IEEE80211_ML_CONTROL_TYPE_BASIC:
                common += sizeof(struct ieee80211_mle_basic_common_info);
-               check_common_len = true;
                if (control & IEEE80211_MLC_BASIC_PRES_LINK_ID)
                        common += 1;
                if (control & IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT)
@@ -888,9 +887,9 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
                common += sizeof(struct ieee80211_mle_preq_common_info);
                if (control & IEEE80211_MLC_PREQ_PRES_MLD_ID)
                        common += 1;
-               check_common_len = true;
                break;
        case IEEE80211_ML_CONTROL_TYPE_RECONF:
+               common += 1;
                if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR)
                        common += ETH_ALEN;
                if (control & IEEE80211_MLC_RECONF_PRES_EML_CAPA)
@@ -902,7 +901,6 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
                break;
        case IEEE80211_ML_CONTROL_TYPE_TDLS:
                common += sizeof(struct ieee80211_mle_tdls_common_info);
-               check_common_len = true;
                break;
        case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
                common = ETH_ALEN + 1;
@@ -915,11 +913,9 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
        if (len < fixed + common)
                return false;
 
-       if (!check_common_len)
-               return true;
+       common_len = mle->variable[0];
 
-       /* if present, common length is the first octet there */
-       return mle->variable[0] >= common;
+       return common_len >= common && common_len <= len - fixed;
 }
 
 /**