From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 903CB429811 for ; Wed, 10 Jun 2026 15:43:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781106192; cv=none; b=G8ya3fvQmd/lYfGxJqiNAYyntBJtQ9xX5bBwkGRIZTV7J5gKwTqSpyzmdQMP40ef0xlyvhH9Wtag/mTUvTaQ+DymDQQscChbrIl/oz7SvBxWaEgMBvzaU1d+luM2mn1iVDiK+JcUqHhT+8VmhTGONwSXGnUfXFerKNGzapCmKfU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781106192; c=relaxed/simple; bh=xqZfYDYPDBPN7aKZCdWGjnvMLnaV5O+1fNS2MXClDPk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FFLLlrMMwWJ3FRkA7DL0R6eeHW8QvEd/mR7k2Q+FJ8YW0s0vuHUuaAltuypLHRlCQwq0yHM87i8EOr+7RndI+bglo4o9LxxOwM7m3iOtIE4EHSQJTFU2z3VWABdeNZD8i6i52DGXJcY/7ycdywOxCCR8CrMBTRIJUFynHvABAkU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NqTl75qY; arc=none smtp.client-ip=209.85.215.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NqTl75qY" Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-c855599a77aso3515324a12.0 for ; Wed, 10 Jun 2026 08:43:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781106191; x=1781710991; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=9XDGbUf4iEhNvwcof5vdLMuCB999+9vu1yeTxgx41Mo=; b=NqTl75qYL4rVakJ66OV9nA+0nOuFRfU4qnWPcxbMPT4q05LHakfYVq6OahMxifGPwk 5BjFJn/G3EHoAEO7RfL23QYrroGqaYHiI5DuBgxgMlIat2fbJyyvZz4twZnZ2gUwXxub oGdTKqe8W30GCc0v5+IYFDBSBIe4NtzBOPUXYCLlkmZBHPol/jODAXeHq1/62aSmcH9i 23wG+A9Xs7r6bxd6aKuAcmQHBWpF3paknj0rvKw/MRSuM+OmHZauQdsk0VVFcBHdDkTt tS7y43FGqI+6bayXkH0BS6CitJ4bPfaNl3bW3c19jFhQnU1fkYB47O17ksXjUcywMe2y VYuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781106191; x=1781710991; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=9XDGbUf4iEhNvwcof5vdLMuCB999+9vu1yeTxgx41Mo=; b=VskWo8fNHQWpHDKNZK68HQYyDn5xDQDgeXUmQjUnzFridMYGtbQ/ZcLgLFRVxS8V9v bqADNjiu9iJUJlRchiJEz044ooc0BqcsoCw34GC+gbs/dq6T1oxY3yyv7FXomkTsX+lG pA2NLTQnn2yJ5k5RprKwVoBDPQOzmoYKaukNn8soYLaPvu4ZPUaKav5GsCkziX8EcVWK kEj44Tz1JtYQ4pTKPFLB/8tLRKC9H4hgs06hcB0CpypBPonl3UgfAEzXnjijBNvyL/46 L92Kw3gNYCkEg3h+0FFhZulYccG9yC/YnqH7RJji+w7iJKv75rcbjqoFCuYtNz3NbkAB CPJw== X-Forwarded-Encrypted: i=1; AFNElJ+0sK0KjUJ7FLd6oiBZXM/JjM6WjgrfgpC3LsI4z9bV4B/huNECV8g1f96E57aAhxLpNSlNzd/9So+YgK4=@vger.kernel.org X-Gm-Message-State: AOJu0Ywk2GCzPsy9Dm0bw0hqNVJfATrhCKPP2NmRBdNffYLHx56htaXf FKwaVlyAdTbUmpN7uZ12apuelFLvt/VgCqJNVm1C9tYpuMysW2hwf0AW X-Gm-Gg: Acq92OFWF7aM+uCtwXGGzWoHRbUP2mgPANsPuxd/zI3rE44y1nqXKrIpgYhd4GkGwuj FM3Io2V03mfhBPH8qgr96ijaQxwB2s+h99622wygXSQMViTqwECg6gxSrKtKjpqnN+EnnBrbZ0J ywWEfsDelQ2kZkmnX6WvmMlP44LGvzosKtU3KmOHH5dd0M3NdVFZnk0FcDZKhDAUits2w5fRwC5 5bwhIyt09xrMSbWlYRezO97+z01rnEuniyDF+Q4BgYywlSc9zXPAyzLsAESqjfPCpOgy5OthCcO /KQbYbK8P1/SwWylzRr3MIfgKS9iXBsxSFb2AOzIkGaHI9qRENzYpddnL2vTTS669AYXsi0m65J wedW2glzNx7ZzIpa7vy2RWqIL+RhAVE6Wfvsx4XnuCwkyn+Y+skcPcaKBp12sIaMSmgHK35ebDH jjNJtmOoWGVoSFTe5qpU8v3eGztlXVJ31W/Z/K2IlTYgTnq+CweMNfT3kZRJKjqcJcL5h/o1Laf A== X-Received: by 2002:a05:6a21:7a82:b0:3b4:85db:1bea with SMTP id adf61e73a8af0-3b4ccd1b486mr31060842637.5.1781106190947; Wed, 10 Jun 2026 08:43:10 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([139.177.225.252]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c85df0b26bbsm21482885a12.23.2026.06.10.08.43.08 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 10 Jun 2026 08:43:10 -0700 (PDT) From: Zhao Li To: Johannes Berg Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Zhao Li , stable@vger.kernel.org Subject: [PATCH] wifi: ieee80211: validate MLE common info length Date: Wed, 10 Jun 2026 23:43:03 +0800 Message-ID: <20260610154303.37079-1-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ieee80211_mle_size_ok() verifies that the advertised common information length is large enough for the fixed fields that are present, but it does not verify that the length also fits in the containing element. Reconfiguration and Priority Access MLEs also carry a common information length octet, but currently skip the common-length check. Reconfiguration additionally fails to include the length octet in the minimum common size. Validate the common information length for Reconfiguration and Priority Access MLEs, account for the Reconfiguration length octet, and reject common lengths that exceed the element body. Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element") Cc: stable@vger.kernel.org Signed-off-by: Zhao Li --- include/linux/ieee80211-eht.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index a97b1d01f3acf..d875045abf6cc 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -878,6 +878,8 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) check_common_len = true; break; case IEEE80211_ML_CONTROL_TYPE_RECONF: + common += 1; + check_common_len = true; if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR) common += ETH_ALEN; if (control & IEEE80211_MLC_RECONF_PRES_EML_CAPA) @@ -893,6 +895,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) break; case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: common = ETH_ALEN + 1; + check_common_len = true; break; default: /* we don't know this type */ @@ -906,7 +909,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) return true; /* if present, common length is the first octet there */ - return mle->variable[0] >= common; + return mle->variable[0] >= common && mle->variable[0] <= len - fixed; } /** -- 2.50.1 (Apple Git-155)