lkml.org 
[lkml]   [2021]   [Dec]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 011/177] mac80211: validate extended element ID is present
    Date
    From: Johannes Berg <johannes.berg@intel.com>

    commit 768c0b19b50665e337c96858aa2b7928d6dcf756 upstream.

    Before attempting to parse an extended element, verify that
    the extended element ID is present.

    Fixes: 41cbb0f5a295 ("mac80211: add support for HE")
    Reported-by: syzbot+59bdff68edce82e393b6@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/r/20211211201023.f30a1b128c07.I5cacc176da94ba316877c6e10fe3ceec8b4dbd7d@changeid
    Cc: stable@vger.kernel.org
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/mac80211/util.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/net/mac80211/util.c
    +++ b/net/mac80211/util.c
    @@ -943,7 +943,12 @@ static void ieee80211_parse_extension_el
    struct ieee802_11_elems *elems)
    {
    const void *data = elem->data + 1;
    - u8 len = elem->datalen - 1;
    + u8 len;
    +
    + if (!elem->datalen)
    + return;
    +
    + len = elem->datalen - 1;

    switch (elem->data[0]) {
    case WLAN_EID_EXT_HE_MU_EDCA:

    \
     
     \ /
      Last update: 2021-12-20 16:04    [W:4.035 / U:0.200 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site