[PATCH] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications

[PATCH] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications

[Thiyagarajan Pandiyan]

Currently, ie_len in cfg80211_notify_new_peer_candidate is defined as
1-byte field, capping the maximum IE list size at 255 bytes. When a
large beacon is received, the IE list is truncated, passing incomplete
data to wpa_supplicant. This causes supplicant to fail parsing the IEs.

Increasing the size of ie_len to allow the full length of the IE list to
be forwarded properly.

Signed-off-by: Thiyagarajan Pandiyan <thiyagarajan@aerlync.com>
---
 net/wireless/nl80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7db9cd433801..0d97a47c35fb 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -20958,7 +20958,7 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
 }
 
 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
-					const u8 *ie, u8 ie_len,
+					const u8 *ie, size_t ie_len,
 					int sig_dbm, gfp_t gfp)
 {
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
-- 
2.43.0

Re: [PATCH] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications

[kernel test robot]

Hi Thiyagarajan,

kernel test robot noticed the following build errors:

[auto build test ERROR on wireless-next/main]
[also build test ERROR on wireless/main linus/master v6.16-rc1 next-20260604]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Thiyagarajan-Pandiyan/wifi-nl80211-Increase-ie_len-size-to-prevent-truncated-IEs-in-new-peer-notifications/20260605-043726
base:   https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link:    https://lore.kernel.org/r/20260604203027.406815-1-thiyagarajan%40aerlync.com
patch subject: [PATCH] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
config: x86_64-kexec (https://download.01.org/0day-ci/archive/20260605/202606050734.F3c2JaGN-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project f43d6834093b19baf79beda8c0337ab020ac5f17)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260605/202606050734.F3c2JaGN-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606050734.F3c2JaGN-lkp@intel.com/

All errors (new ones prefixed by >>):

>> net/wireless/nl80211.c:21357:6: error: conflicting types for 'cfg80211_notify_new_peer_candidate'
    21357 | void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
          |      ^
   include/net/cfg80211.h:8687:6: note: previous declaration is here
    8687 | void cfg80211_notify_new_peer_candidate(struct net_device *dev,
         |      ^
   1 error generated.


vim +/cfg80211_notify_new_peer_candidate +21357 net/wireless/nl80211.c

04a773ade0680d Johannes Berg         2009-04-19  21356  
947add36ca2dcd Johannes Berg         2013-02-22 @21357  void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
a63204d4bff16d Thiyagarajan Pandiyan 2026-06-05  21358  					const u8 *ie, size_t ie_len,
ecbc12ad6b6826 Bob Copeland          2018-10-26  21359  					int sig_dbm, gfp_t gfp)
c93b5e717ec47b Javier Cardona        2011-04-07  21360  {
947add36ca2dcd Johannes Berg         2013-02-22  21361  	struct wireless_dev *wdev = dev->ieee80211_ptr;
f26cbf401be935 Zhao, Gang            2014-04-21  21362  	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
c93b5e717ec47b Javier Cardona        2011-04-07  21363  	struct sk_buff *msg;
c93b5e717ec47b Javier Cardona        2011-04-07  21364  	void *hdr;
c93b5e717ec47b Javier Cardona        2011-04-07  21365  
947add36ca2dcd Johannes Berg         2013-02-22  21366  	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
947add36ca2dcd Johannes Berg         2013-02-22  21367  		return;
947add36ca2dcd Johannes Berg         2013-02-22  21368  
947add36ca2dcd Johannes Berg         2013-02-22  21369  	trace_cfg80211_notify_new_peer_candidate(dev, addr);
947add36ca2dcd Johannes Berg         2013-02-22  21370  
4ef8c1c93f848e Johannes Berg         2017-01-09  21371  	msg = nlmsg_new(100 + ie_len, gfp);
c93b5e717ec47b Javier Cardona        2011-04-07  21372  	if (!msg)
c93b5e717ec47b Javier Cardona        2011-04-07  21373  		return;
c93b5e717ec47b Javier Cardona        2011-04-07  21374  
c93b5e717ec47b Javier Cardona        2011-04-07  21375  	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
c93b5e717ec47b Javier Cardona        2011-04-07  21376  	if (!hdr) {
c93b5e717ec47b Javier Cardona        2011-04-07  21377  		nlmsg_free(msg);
c93b5e717ec47b Javier Cardona        2011-04-07  21378  		return;
c93b5e717ec47b Javier Cardona        2011-04-07  21379  	}
c93b5e717ec47b Javier Cardona        2011-04-07  21380  
9360ffd1859720 David S. Miller       2012-03-29  21381  	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
947add36ca2dcd Johannes Berg         2013-02-22  21382  	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
947add36ca2dcd Johannes Berg         2013-02-22  21383  	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9360ffd1859720 David S. Miller       2012-03-29  21384  	    (ie_len && ie &&
ecbc12ad6b6826 Bob Copeland          2018-10-26  21385  	     nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
ecbc12ad6b6826 Bob Copeland          2018-10-26  21386  	    (sig_dbm &&
ecbc12ad6b6826 Bob Copeland          2018-10-26  21387  	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
9360ffd1859720 David S. Miller       2012-03-29  21388  		goto nla_put_failure;
c93b5e717ec47b Javier Cardona        2011-04-07  21389  
3b7b72eed19684 Johannes Berg         2011-10-22  21390  	genlmsg_end(msg, hdr);
c93b5e717ec47b Javier Cardona        2011-04-07  21391  
68eb55031da7c9 Johannes Berg         2013-11-19  21392  	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
2a94fe48f32ccf Johannes Berg         2013-11-19  21393  				NL80211_MCGRP_MLME, gfp);
c93b5e717ec47b Javier Cardona        2011-04-07  21394  	return;
c93b5e717ec47b Javier Cardona        2011-04-07  21395  
c93b5e717ec47b Javier Cardona        2011-04-07  21396   nla_put_failure:
c93b5e717ec47b Javier Cardona        2011-04-07  21397  	nlmsg_free(msg);
c93b5e717ec47b Javier Cardona        2011-04-07  21398  }
947add36ca2dcd Johannes Berg         2013-02-22  21399  EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
c93b5e717ec47b Javier Cardona        2011-04-07  21400  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications

[kernel test robot]

Hi Thiyagarajan,

kernel test robot noticed the following build errors:

[auto build test ERROR on wireless-next/main]
[also build test ERROR on wireless/main linus/master v7.1-rc6 next-20260604]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Thiyagarajan-Pandiyan/wifi-nl80211-Increase-ie_len-size-to-prevent-truncated-IEs-in-new-peer-notifications/20260605-043726
base:   https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link:    https://lore.kernel.org/r/20260604203027.406815-1-thiyagarajan%40aerlync.com
patch subject: [PATCH] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
config: x86_64-rhel-9.4-kunit (https://download.01.org/0day-ci/archive/20260605/202606050936.McGTSygg-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260605/202606050936.McGTSygg-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606050936.McGTSygg-lkp@intel.com/

All errors (new ones prefixed by >>):

>> net/wireless/nl80211.c:21357:6: error: conflicting types for 'cfg80211_notify_new_peer_candidate'; have 'void(struct net_device *, const u8 *, const u8 *, size_t,  int,  gfp_t)' {aka 'void(struct net_device *, const unsigned char *, const unsigned char *, long unsigned int,  int,  unsigned int)'}
   21357 | void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
         |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   In file included from net/wireless/nl80211.c:27:
   include/net/cfg80211.h:8687:6: note: previous declaration of 'cfg80211_notify_new_peer_candidate' with type 'void(struct net_device *, const u8 *, const u8 *, u8,  int,  gfp_t)' {aka 'void(struct net_device *, const unsigned char *, const unsigned char *, unsigned char,  int,  unsigned int)'}
    8687 | void cfg80211_notify_new_peer_candidate(struct net_device *dev,
         |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   In file included from include/linux/linkage.h:7,
                    from include/linux/kernel.h:18,
                    from include/linux/uio.h:8,
                    from include/linux/socket.h:8,
                    from include/uapi/linux/if.h:25,
                    from net/wireless/nl80211.c:11:
   net/wireless/nl80211.c:21399:15: error: conflicting types for 'cfg80211_notify_new_peer_candidate'; have 'void(struct net_device *, const u8 *, const u8 *, size_t,  int,  gfp_t)' {aka 'void(struct net_device *, const unsigned char *, const unsigned char *, long unsigned int,  int,  unsigned int)'}
   21399 | EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
         |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/export.h:76:28: note: in definition of macro '__EXPORT_SYMBOL'
      76 |         extern typeof(sym) sym;                                 \
         |                            ^~~
   include/linux/export.h:89:41: note: in expansion of macro '_EXPORT_SYMBOL'
      89 | #define EXPORT_SYMBOL(sym)              _EXPORT_SYMBOL(sym, "")
         |                                         ^~~~~~~~~~~~~~
   net/wireless/nl80211.c:21399:1: note: in expansion of macro 'EXPORT_SYMBOL'
   21399 | EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
         | ^~~~~~~~~~~~~
   include/net/cfg80211.h:8687:6: note: previous declaration of 'cfg80211_notify_new_peer_candidate' with type 'void(struct net_device *, const u8 *, const u8 *, u8,  int,  gfp_t)' {aka 'void(struct net_device *, const unsigned char *, const unsigned char *, unsigned char,  int,  unsigned int)'}
    8687 | void cfg80211_notify_new_peer_candidate(struct net_device *dev,
         |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


vim +21357 net/wireless/nl80211.c

04a773ade0680d Johannes Berg         2009-04-19  21356  
947add36ca2dcd Johannes Berg         2013-02-22 @21357  void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
a63204d4bff16d Thiyagarajan Pandiyan 2026-06-05  21358  					const u8 *ie, size_t ie_len,
ecbc12ad6b6826 Bob Copeland          2018-10-26  21359  					int sig_dbm, gfp_t gfp)
c93b5e717ec47b Javier Cardona        2011-04-07  21360  {
947add36ca2dcd Johannes Berg         2013-02-22  21361  	struct wireless_dev *wdev = dev->ieee80211_ptr;
f26cbf401be935 Zhao, Gang            2014-04-21  21362  	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
c93b5e717ec47b Javier Cardona        2011-04-07  21363  	struct sk_buff *msg;
c93b5e717ec47b Javier Cardona        2011-04-07  21364  	void *hdr;
c93b5e717ec47b Javier Cardona        2011-04-07  21365  
947add36ca2dcd Johannes Berg         2013-02-22  21366  	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
947add36ca2dcd Johannes Berg         2013-02-22  21367  		return;
947add36ca2dcd Johannes Berg         2013-02-22  21368  
947add36ca2dcd Johannes Berg         2013-02-22  21369  	trace_cfg80211_notify_new_peer_candidate(dev, addr);
947add36ca2dcd Johannes Berg         2013-02-22  21370  
4ef8c1c93f848e Johannes Berg         2017-01-09  21371  	msg = nlmsg_new(100 + ie_len, gfp);
c93b5e717ec47b Javier Cardona        2011-04-07  21372  	if (!msg)
c93b5e717ec47b Javier Cardona        2011-04-07  21373  		return;
c93b5e717ec47b Javier Cardona        2011-04-07  21374  
c93b5e717ec47b Javier Cardona        2011-04-07  21375  	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
c93b5e717ec47b Javier Cardona        2011-04-07  21376  	if (!hdr) {
c93b5e717ec47b Javier Cardona        2011-04-07  21377  		nlmsg_free(msg);
c93b5e717ec47b Javier Cardona        2011-04-07  21378  		return;
c93b5e717ec47b Javier Cardona        2011-04-07  21379  	}
c93b5e717ec47b Javier Cardona        2011-04-07  21380  
9360ffd1859720 David S. Miller       2012-03-29  21381  	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
947add36ca2dcd Johannes Berg         2013-02-22  21382  	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
947add36ca2dcd Johannes Berg         2013-02-22  21383  	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9360ffd1859720 David S. Miller       2012-03-29  21384  	    (ie_len && ie &&
ecbc12ad6b6826 Bob Copeland          2018-10-26  21385  	     nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
ecbc12ad6b6826 Bob Copeland          2018-10-26  21386  	    (sig_dbm &&
ecbc12ad6b6826 Bob Copeland          2018-10-26  21387  	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
9360ffd1859720 David S. Miller       2012-03-29  21388  		goto nla_put_failure;
c93b5e717ec47b Javier Cardona        2011-04-07  21389  
3b7b72eed19684 Johannes Berg         2011-10-22  21390  	genlmsg_end(msg, hdr);
c93b5e717ec47b Javier Cardona        2011-04-07  21391  
68eb55031da7c9 Johannes Berg         2013-11-19  21392  	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
2a94fe48f32ccf Johannes Berg         2013-11-19  21393  				NL80211_MCGRP_MLME, gfp);
c93b5e717ec47b Javier Cardona        2011-04-07  21394  	return;
c93b5e717ec47b Javier Cardona        2011-04-07  21395  
c93b5e717ec47b Javier Cardona        2011-04-07  21396   nla_put_failure:
c93b5e717ec47b Javier Cardona        2011-04-07  21397  	nlmsg_free(msg);
c93b5e717ec47b Javier Cardona        2011-04-07  21398  }
947add36ca2dcd Johannes Berg         2013-02-22  21399  EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
c93b5e717ec47b Javier Cardona        2011-04-07  21400  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications

[Thiyagarajan Pandiyan]

Hi Johannes,
Could you please review this patch and provide feedback?

Thanks,
Thiyagarajan


Thiyagarajan


On Fri, Jun 5, 2026 at 11:13 AM Thiyagarajan Pandiyan
<thiyagarajan@aerlync.com> wrote:
>
> Currently, ie_len in cfg80211_notify_new_peer_candidate is defined as
> 1-byte field, capping the maximum IE list size at 255 bytes. When a
> large beacon is received, the IE list is truncated, passing incomplete
> data to wpa_supplicant. This causes supplicant to fail parsing the IEs.
>
> Increasing the size of ie_len to allow the full length of the IE list to
> be forwarded properly.
>
> Signed-off-by: Thiyagarajan Pandiyan <thiyagarajan@aerlync.com>
> ---
>  include/net/cfg80211.h | 2 +-
>  net/wireless/nl80211.c | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
> index 9d3639ff9c28..36af36533cac 100644
> --- a/include/net/cfg80211.h
> +++ b/include/net/cfg80211.h
> @@ -8445,7 +8445,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
>   * cfg80211 then sends a notification to userspace.
>   */
>  void cfg80211_notify_new_peer_candidate(struct net_device *dev,
> -               const u8 *macaddr, const u8 *ie, u8 ie_len,
> +               const u8 *macaddr, const u8 *ie, size_t ie_len,
>                 int sig_dbm, gfp_t gfp);
>
>  /**
> diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> index 7db9cd433801..0d97a47c35fb 100644
> --- a/net/wireless/nl80211.c
> +++ b/net/wireless/nl80211.c
> @@ -20958,7 +20958,7 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
>  }
>
>  void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
> -                                       const u8 *ie, u8 ie_len,
> +                                       const u8 *ie, size_t ie_len,
>                                         int sig_dbm, gfp_t gfp)
>  {
>         struct wireless_dev *wdev = dev->ieee80211_ptr;
> --
> 2.43.0
>

[PATCH] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications

[Thiyagarajan Pandiyan]

Currently, ie_len in cfg80211_notify_new_peer_candidate is defined as
1-byte field, capping the maximum IE list size at 255 bytes. When a
large beacon is received, the IE list is truncated, passing incomplete
data to wpa_supplicant. This causes supplicant to fail parsing the IEs.

Increasing the size of ie_len to allow the full length of the IE list to
be forwarded properly.

Signed-off-by: Thiyagarajan Pandiyan <thiyagarajan@aerlync.com>
---
 include/net/cfg80211.h | 2 +-
 net/wireless/nl80211.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 9d3639ff9c28..36af36533cac 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -8445,7 +8445,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
  * cfg80211 then sends a notification to userspace.
  */
 void cfg80211_notify_new_peer_candidate(struct net_device *dev,
-		const u8 *macaddr, const u8 *ie, u8 ie_len,
+		const u8 *macaddr, const u8 *ie, size_t ie_len,
 		int sig_dbm, gfp_t gfp);
 
 /**
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7db9cd433801..0d97a47c35fb 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -20958,7 +20958,7 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
 }
 
 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
-					const u8 *ie, u8 ie_len,
+					const u8 *ie, size_t ie_len,
 					int sig_dbm, gfp_t gfp)
 {
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
-- 
2.43.0