Commit 4dc3a389 authored by Johannes Berg's avatar Johannes Berg
Browse files

wifi: cfg80211: validate HE operation element parsing 



Validate that the HE operation element has the correct
length before parsing it.

Cc: stable@vger.kernel.org
Fixes: 645f3d85 ("wifi: cfg80211: handle UHB AP and STA power type")
Reviewed-by: default avatarMiriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240523120533.677025eb4a92.I44c091029ef113c294e8fe8b9bf871bf5dbeeb27@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 44c06bbd

net/wireless/scan.c

+2 −1
Original line number Diff line number Diff line
@@ -2128,7 +2128,8 @@ static bool cfg80211_6ghz_power_type_valid(const u8 *ie, size_t ielen, 
	struct ieee80211_he_operation *he_oper;



	tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ielen);

	if (tmp && tmp->datalen >= sizeof(*he_oper) + 1) {

	if (tmp && tmp->datalen >= sizeof(*he_oper) + 1 &&

	    tmp->datalen >= ieee80211_he_oper_size(tmp->data + 1)) {

		const struct ieee80211_he_6ghz_oper *he_6ghz_oper;



		he_oper = (void *)&tmp->data[1];