wifi: iwlwifi: mld: fix an off-by-1 boundary check

Before looking at the 11th byte, check the length is big enough.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.336b527e3fc6.I6fe839f4e70d673632fd7ca757e81827af87b029@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 17286b3341c0203d279cc1ec1c0e4721a16454aa..9ac17be3040082aa083ca9f4e80018215ee23986 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -1708,7 +1708,7 @@ static void iwl_mld_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
        elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies->data,
                                  ies->len);
 
-       if (!elem || elem->datalen < 10 ||
+       if (!elem || elem->datalen < 11 ||
            !(elem->data[10] &
              WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
                *tolerated = false;