diff options
| author | Zhao Li <enderaoelyther@gmail.com> | 2026-07-28 19:13:26 +0800 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-07-28 16:04:16 +0200 |
| commit | 4a0bd262df757b25fc4e2a53c947317c119ced4e (patch) | |
| tree | 8a39f28682a9df0a9ecda512d852c3dc338a89b0 | |
| parent | 7d86b0a8aceff34f7178e39261966903de01c2a1 (diff) | |
| download | linux-next-4a0bd262df757b25fc4e2a53c947317c119ced4e.tar.gz linux-next-4a0bd262df757b25fc4e2a53c947317c119ced4e.zip | |
wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
ieee80211_mgd_check_cross_link_csa() starts parsing elements after the
fixed per-STA profile header and the STA Info field, but subtracts only
the STA Info length from the profile length. As a result,
ieee802_11_parse_elems() is given sizeof(*prof) == 3 bytes beyond the
current profile's element area, and data following the profile may be
interpreted as belonging to it.
Subtract the fixed profile header as well. The preceding
ieee80211_mle_basic_sta_prof_size_ok() check guarantees that the
corrected calculation cannot underflow, and
ieee80211_rx_uhr_link_reconfig_req() uses the same calculation.
The call site currently states that cross-link CSA parsing has no effect
because the broader parsing is still incorrect. This patch does not
address that broader problem; it only makes the per-STA profile parser
stop at the end of that profile. No production allocation over-read or
user-visible failure has been demonstrated.
Fixes: 7ef8f6821d16 ("wifi: mac80211: mlme: handle cross-link CSA")
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Kimi:K3
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260728111326.63087-1-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/mlme.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 50587ab110d2..f51167f0fc46 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -8027,7 +8027,7 @@ ieee80211_mgd_check_cross_link_csa(struct ieee80211_sub_if_data *sdata, prof = (void *)sta_profiles[link_id]; prof_elems = ieee802_11_parse_elems(prof->variable + (prof->sta_info_len - 1), - len - + len - sizeof(*prof) - (prof->sta_info_len - 1), IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON, |