diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c index 030da4679ca3..f3c5a9f6ec7c 100644 --- a/net/mac80211/parse.c +++ b/net/mac80211/parse.c @@ -449,12 +449,15 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params, IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; break; case WLAN_EID_TIM: - if (elen >= sizeof(struct ieee80211_tim_ie)) { + if ((params->mode == IEEE80211_CONN_MODE_S1G && + elen >= 2 /* control/PVB are optional */) || + elen >= sizeof(struct ieee80211_tim_ie)) { elems->tim = (void *)pos; elems->tim_len = elen; - } else + } else { elem_parse_failed = IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; + } break; case WLAN_EID_VENDOR_SPECIFIC: if (elems_parse->skip_vendor)