wifi: mac80211: handle shorter S1G TIM when parsing elements

An S1G TIM, unlike the regular TIM, can exclude both the bitmap
control and the PVB. As a result it's minimum length is actually 2.
Fix this by allowing a shorter TIM for S1G connections.

Suggested-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
Link: https://patch.msgid.link/20261008030939.474493-2-lachlan.hodges@morsemicro.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Lachlan Hodges 2026-10-08 14:09:38 +11:00 committed by Johannes Berg
parent 0fdd10cac4
commit 8662a5ecd6

View File

@ -449,12 +449,15 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
break;
case WLAN_EID_TIM:
if (elen >= sizeof(struct ieee80211_tim_ie)) {
if ((params->mode == IEEE80211_CONN_MODE_S1G &&
elen >= 2 /* control/PVB are optional */) ||
elen >= sizeof(struct ieee80211_tim_ie)) {
elems->tim = (void *)pos;
elems->tim_len = elen;
} else
} else {
elem_parse_failed =
IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
}
break;
case WLAN_EID_VENDOR_SPECIFIC:
if (elems_parse->skip_vendor)