iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cfg80211: check S1G beacon compat element length

Browse Source 
commit b5ac0146492fc5c199de767e492be8a66471011a upstream.

We need to check the length of this element so that we don't
access data beyond its end. Fix that.

Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results")
Link: https://lore.kernel.org/r/20210408142826.f6f4525012de.I9fdeff0afdc683a6024e5ea49d2daa3cd2459d11@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johannes Berg 2021-04-08 14:28:27 +02:00 committed by Greg Kroah-Hartman
parent fea52345f4
commit cc1a702e6e
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/wireless/scan.c
View File

@ -2351,14 +2351,16 @@ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
return NULL;
if (ext) {
struct ieee80211_s1g_bcn_compat_ie *compat;
u8 *ie;
const struct ieee80211_s1g_bcn_compat_ie *compat;
const struct element *elem;
ie = (void *)cfg80211_find_ie(WLAN_EID_S1G_BCN_COMPAT,
variable, ielen);
if (!ie)
elem = cfg80211_find_elem(WLAN_EID_S1G_BCN_COMPAT,
variable, ielen);
if (!elem)
return NULL;
compat = (void *)(ie + 2);
if (elem->datalen < sizeof(*compat))
return NULL;
compat = (void *)elem->data;
bssid = ext->u.s1g_beacon.sa;
capability = le16_to_cpu(compat->compat_info);
beacon_int = le16_to_cpu(compat->beacon_int);