Commit a6e6ccd5 authored by Michael Bommarito's avatar Michael Bommarito Committed by Johannes Berg
Browse files

wifi: mac80211: consume only present negotiated TTLM maps 



ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements
against the number of link-map entries indicated by link_map_presence.
ieee80211_parse_neg_ttlm() must consume the same layout.

The parser advanced its cursor for every TID, including TIDs whose
presence bit is clear and therefore have no map bytes in the element.
A sparse map can then make a later present TID read past the validated
element.

The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by
valid_links before being applied to driver state, so a peer cannot
turn the read into a policy change.  Under KUnit + KASAN with an
exact-sized element allocation the OOB read is reported as a
slab-out-of-bounds; whether the same trigger fires under the
production RX path depends on surrounding allocator state.

Advance the cursor only when the current TID has a map present.

Fixes: 8f500fbc ("wifi: mac80211: process and save negotiated TID to Link mapping request")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: default avatarMichael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260515151719.1317659-2-michael.bommarito@gmail.com


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent dd7b6a86

net/mac80211/mlme.c

+1 −1
Original line number Diff line number Diff line
@@ -8164,6 +8164,7 @@ ieee80211_parse_neg_ttlm(struct ieee80211_sub_if_data *sdata, 
					 "No active links for TID %d", tid);

				return -EINVAL;

			}

			pos += map_size;

		} else {

			map = 0;

		}
@@ -8182,7 +8183,6 @@ ieee80211_parse_neg_ttlm(struct ieee80211_sub_if_data *sdata, 
		default:

			return -EINVAL;

		}

		pos += map_size;

	}

	return 0;

}