github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 20:54:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: nxpwifi: reject zero-length extension elements in beacon IEs

Browse Source 
nxpwifi_update_bss_desc_with_ie() dispatches on elem->data[0] for
WLAN_EID_EXTENSION without checking that the element has a payload.
A well-formed extension element carries at least the element ID
extension byte, but nothing enforces that in the IE stream, and the
loop accepts a zero-length element because its header alone fits.
elem->data[0] then reads the byte after the element, which is past the
kmemdup()ed IE buffer when that element ends the stream.

Fixes: 73b01e57ed ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260724103656.2494129-1-lilinmao@kylinos.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Linmao Li 2026-07-24 18:36:56 +08:00 committed by Johannes Berg
parent 905b418df8
commit 8e4f5ca8bf
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/wireless/nxp/nxpwifi/scan.c
View File

@ -1255,6 +1255,9 @@ int nxpwifi_update_bss_desc_with_ie(struct nxpwifi_adapter *adapter,
(u16)(current_ptr - bss_entry->beacon_buf);
break;
case WLAN_EID_EXTENSION:
if (!element_len)
return -EINVAL;
elem = (struct element *)current_ptr;
switch (elem->data[0]) {