Commit 98849ba2 authored by Johannes Berg's avatar Johannes Berg
Browse files

wifi: mac80211: check defragmentation succeeded 



We need to check that cfg80211_defragment_element()
didn't return an error, since it can fail due to bad
input, and we didn't catch that before.

Fixes: 8eb8dd2f ("wifi: mac80211: Support link removal using Reconfiguration ML element")
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231211085121.8595a6b67fc0.I1225edd8f98355e007f96502e358e476c7971d8c@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 63bafd9d

net/mac80211/mlme.c

+3 −1
Original line number Diff line number Diff line
@@ -5782,7 +5782,7 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata, 
{

	const struct ieee80211_multi_link_elem *ml;

	const struct element *sub;

	size_t ml_len;

	ssize_t ml_len;

	unsigned long removed_links = 0;

	u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {};

	u8 link_id;
@@ -5798,6 +5798,8 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata, 
					     elems->scratch + elems->scratch_len -

					     elems->scratch_pos,

					     WLAN_EID_FRAGMENT);

	if (ml_len < 0)

		return;



	elems->ml_reconf = (const void *)elems->scratch_pos;

	elems->ml_reconf_len = ml_len;