mirror of
https://github.com/torvalds/linux.git
synced 2026-09-19 09:08:02 +02:00
61a799ffd1
at76_guess_freq() checks only that the received frame is at least a bare
802.11 header (24 bytes) before subtracting the fixed management-body
offset:
len -= el_off;
For both beacon and probe response frames, el_off is 36. If the frame is
shorter than el_off, subtracting it causes the calculated IE length to
wrap. The length is eventually passed to cfg80211_find_elem_match() as a
very large unsigned value, so the element walk runs beyond the RX skb.
This path is reached from at76_rx_tasklet() while scanning. If the device
delivers a truncated beacon or probe response, the oversized IE length
causes an out-of-bounds read during scanning.
Skip the IE lookup if the frame does not reach the variable elements,
before subtracting el_off.
Fixes:
|
||
|---|---|---|
| .. | ||
| at76c50x-usb.c | ||
| at76c50x-usb.h | ||
| Kconfig | ||
| Makefile | ||