diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2024-07-24 13:29:12 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2024-07-26 12:32:47 +0200 |
| commit | 6873cc4416078202882691b424fcca5b5fb1a94d (patch) | |
| tree | bce6aab46a16dbf1cc9856898b7bf3d395681926 /net | |
| parent | baeaabf970b9a90999f62ae27edf63f6cb86c023 (diff) | |
| download | linux-stable-6873cc4416078202882691b424fcca5b5fb1a94d.tar.gz linux-stable-6873cc4416078202882691b424fcca5b5fb1a94d.tar.bz2 linux-stable-6873cc4416078202882691b424fcca5b5fb1a94d.zip | |
wifi: cfg80211: correct S1G beacon length calculation
The minimum header length calculation (equivalent to the start
of the elements) for the S1G long beacon erroneously required
only up to the start of u.s1g_beacon rather than the start of
u.s1g_beacon.variable. Fix that, and also shuffle the branches
around a bit to not assign useless values that are overwritten
later.
Reported-by: syzbot+0f3afa93b91202f21939@syzkaller.appspotmail.com
Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results")
Link: https://patch.msgid.link/20240724132912.9662972db7c1.I8779675b5bbda4994cc66f876b6b87a2361c3c0b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/scan.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/net/wireless/scan.c b/net/wireless/scan.c index d99319d82205..64eeed82d43d 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -3178,8 +3178,7 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy, struct ieee80211_mgmt *mgmt, size_t len, gfp_t gfp) { - size_t min_hdr_len = offsetof(struct ieee80211_mgmt, - u.probe_resp.variable); + size_t min_hdr_len; struct ieee80211_ext *ext = NULL; enum cfg80211_bss_frame_type ftype; u16 beacon_interval; @@ -3202,10 +3201,16 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy, if (ieee80211_is_s1g_beacon(mgmt->frame_control)) { ext = (void *) mgmt; - min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon); if (ieee80211_is_s1g_short_beacon(mgmt->frame_control)) min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_short_beacon.variable); + else + min_hdr_len = offsetof(struct ieee80211_ext, + u.s1g_beacon.variable); + } else { + /* same for beacons */ + min_hdr_len = offsetof(struct ieee80211_mgmt, + u.probe_resp.variable); } if (WARN_ON(len < min_hdr_len)) |