Commit 08582067 authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'wireless-2026-01-29' of... 

Merge tag 'wireless-2026-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Just one fix, for a parsing error in mac80211 that might
result in a one byte out-of-bounds read.

* tag 'wireless-2026-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: mac80211: correctly decode TTLM with default link map
====================

Link: https://patch.msgid.link/20260129110403.178036-3-johannes@sipsolutions.net


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents df8b9be3 1eab33aa

net/mac80211/mlme.c

+5 −3
Original line number Diff line number Diff line
@@ -8,7 +8,7 @@ 
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>

 * Copyright 2013-2014  Intel Mobile Communications GmbH

 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH

 * Copyright (C) 2018 - 2025 Intel Corporation

 * Copyright (C) 2018 - 2026 Intel Corporation

 */



#include <linux/delay.h>
@@ -6190,8 +6190,10 @@ ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata, 
		return -EINVAL;

	}



	if (!(control & IEEE80211_TTLM_CONTROL_DEF_LINK_MAP)) {

		link_map_presence = *pos;

		pos++;

	}



	if (control & IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT) {

		ttlm_info->switch_time = get_unaligned_le16(pos);