Commit 03e7e493 authored by Benjamin Berg's avatar Benjamin Berg Committed by Johannes Berg
Browse files

wifi: cfg80211: ignore invalid TBTT info field types 



The TBTT information field type must be zero. This is only changed in
the 802.11be draft specification where the value 1 is used to indicate
that only the MLD parameters are included.

Signed-off-by: default avatarBenjamin Berg <benjamin.berg@intel.com>
Signed-off-by: default avatarGregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230616094949.7865606ffe94.I7ff28afb875d1b4c39acd497df8490a7d3628e3f@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 108d2022

include/linux/ieee80211.h

+2 −0
Original line number Diff line number Diff line
@@ -4481,6 +4481,8 @@ static inline bool for_each_element_completed(const struct element *element, 
#define IEEE80211_AP_INFO_TBTT_HDR_FILTERED			0x04

#define IEEE80211_AP_INFO_TBTT_HDR_COLOC			0x08

#define IEEE80211_AP_INFO_TBTT_HDR_COUNT			0xF0

#define IEEE80211_TBTT_INFO_TYPE_TBTT				0

#define IEEE80211_TBTT_INFO_TYPE_MLD				1

#define IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM		9

#define IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM	13

net/wireless/scan.c

+7 −0
Original line number Diff line number Diff line
@@ -629,6 +629,13 @@ static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies, 
		if (end - pos < count * length)

			break;



		if (u8_get_bits(ap_info->tbtt_info_hdr,

				IEEE80211_AP_INFO_TBTT_HDR_TYPE) !=

		    IEEE80211_TBTT_INFO_TYPE_TBTT) {

			pos += count * length;

			continue;

		}



		/*

		 * TBTT info must include bss param + BSSID +

		 * (short SSID or same_ssid bit to be set).