From 8662a5ecd6f991d81772f33d0fbec3050901c2f6 Mon Sep 17 00:00:00 2001 From: Lachlan Hodges Date: Thu, 8 Oct 2026 14:09:38 +1100 Subject: [PATCH] wifi: mac80211: handle shorter S1G TIM when parsing elements An S1G TIM, unlike the regular TIM, can exclude both the bitmap control and the PVB. As a result it's minimum length is actually 2. Fix this by allowing a shorter TIM for S1G connections. Suggested-by: Johannes Berg Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20261008030939.474493-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg --- net/mac80211/parse.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c index 030da4679ca3..f3c5a9f6ec7c 100644 --- a/net/mac80211/parse.c +++ b/net/mac80211/parse.c @@ -449,12 +449,15 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params, IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; break; case WLAN_EID_TIM: - if (elen >= sizeof(struct ieee80211_tim_ie)) { + if ((params->mode == IEEE80211_CONN_MODE_S1G && + elen >= 2 /* control/PVB are optional */) || + elen >= sizeof(struct ieee80211_tim_ie)) { elems->tim = (void *)pos; elems->tim_len = elen; - } else + } else { elem_parse_failed = IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; + } break; case WLAN_EID_VENDOR_SPECIFIC: if (elems_parse->skip_vendor)