From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 73E583E171A for ; Thu, 11 Jun 2026 17:35:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781199315; cv=none; b=cgI9Agq95grp9DYN2D0G4xo2u8NO6edRTlRvP7CimY0oRyQXrTv3V63Jhc4aFUlnwZEo6aizV+YwxwrLJUve/tkP66gi1iuAKzzTOwZ7FrhP3Y+B48TmDO1SjqZrtML3p41JlifTdWcSvu+sGKS8zeXp7deF/fGk6aHeoGHFBLE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781199315; c=relaxed/simple; bh=FuQd8meff7oP6JE01DWJHh6bS3K5BZBiEhXwQSMVXEs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iZNIucF7L7VhpR9/TvMa+3/H0ZIkJmFgieJ714GlY/bQ0VzGYnpeH/CbtNSzGh6W6XP5jaLEqKiSsfVbfD6eC6eYPtFmLVzN3i0dyZDoZrSjIugEFE38GuHPPZ76a0mAXpb3784SA2rMjECm7/hMP9zEeoiAUv5Ne+0aYISg5a8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FRRf6KQF; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FRRf6KQF" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-36c68964315so130592a91.2 for ; Thu, 11 Jun 2026 10:35:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781199314; x=1781804114; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=ZOh4h1Jbp5Tyf36zO2G+zbdh9lsb9GzpQeGsDyR6Flo=; b=FRRf6KQF4azGjv6YThEWK0B7Fv1icigJzi6/4MaDWj0bv7CizKCkan3LR9Dt7w0IGZ 9Kh5B3caJVj8y3EBgaBjU2KXelvrkCNyW75nwX3KlJo8sm55zV/2jB4bFxla3p5yIRI3 /+zKqOGpgYpgaI3xbG07RQzPfk4i7RwKl+Rhxx9UJU6O8BiMKck0NFmZiIUMiws/IuEM IqUzeeFGlQE03Gle8bNNOE+yZrRd6s6uwoEscGCAYl8jcfEhljIpyrFoDDv7CxyAVQnt WAMmpcQRrSRI4h72ECiarOTOj65MwvmeyLSAuhPjGH2QfPzha7EHMrUevrR+tMgBppMe zQ9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781199314; x=1781804114; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ZOh4h1Jbp5Tyf36zO2G+zbdh9lsb9GzpQeGsDyR6Flo=; b=svS2u3wPwo3R1SE/eS5Wz01xCWfv53oVdeXN9iUOWyDAbyyDWamdfRu6GL0XMlDHJb SpLoh9pa6sPbipzZVgNJGYdnpEXvX0NBTSUDEXZ2WYBRZUKl1/OdSkZpJlhj2ZTZLgM4 XH2RMUgBUAqpKdnEIbGnCxKyARFkHMISZTz6qkPNegWVgUo2HGOQ9+4+qPZUD4Sa6vit cQqfiP/0TfmG0HJAw9OtP+9M8kMbafqykttqJ6GNmC/uE3JiZRBhYcc3g1TmVU6YeY2W 66E0KpTRaYfFUI7aJRsJeUr+u+2ib/0R/GetwFIWQ8gHD+/oTKwdwfOg0EtQYNCNuWQd 0wkw== X-Forwarded-Encrypted: i=1; AFNElJ82zKPTuM0UsM+nVGg8JZMdqnIAFHCzGwvA2P3yPtF+ets036yPdlR/PJ5OLRVqDkY6b9eRnyZc0fZRLDY=@vger.kernel.org X-Gm-Message-State: AOJu0YwHjp7OUzFm5DOUSP1kKNVOu47kXG5F2IhHw6qwEAMC2J+5K/lt icTXCvYWc2t0HjZa2wi/N2QUZuK2Njfe7xojfJza9t6KH7BsEoTipGF9kfoFzh0V0IyQnA== X-Gm-Gg: Acq92OERSIxHFI/6mSrfXzjrTNOj8CzbvrpfDnp+5ESVEHDRISYkuZWUzN9ZtPnu+kV UELyiBTz3pIS/pAUy+T5LvOZ778uuaMFktQv06SxRU47XUatanwy9JeMr3yA+ro/dRWHuS2DSF/ UUM30eZZgDcvUybJ5J5xptZth/LWxEvSRlGaeeQd1+5hNCQt0X1hUO9PIifkp5XlUQLk61ycrAP 74t54iBJf6zSCu8Ej7tBkdO1UVBYDMBMoUsF5NA0wIcjvKjSc7LWnlbPDG0N4ft1UGsFwSet8qI 4KT8mFeViiTILOTh3k0OwrRCGiL0aChaJiF8sS5jJ6gOc4OIQvtZ9Fn56+OUF4R6rdaPyeMgwwc zXi8entOOeVVz8v9Ve+Yc0Xz8YHAh2G3DQwVPFEJWIK4bSJ4pjo6ZYYcoQIHvz9wBZJp6l+yju2 e5yc3iW7Mr1uMMGNvppq/RNVmk/7PAmTdrg85mIqv63vbL/l6C9QNFu2Jn/8Jvve8= X-Received: by 2002:a17:90b:394d:b0:366:3517:1a95 with SMTP id 98e67ed59e1d1-3778edd65b1mr4601128a91.0.1781199313748; Thu, 11 Jun 2026 10:35:13 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([139.177.225.238]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-843380c9307sm2416294b3a.29.2026.06.11.10.35.10 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 11 Jun 2026 10:35:13 -0700 (PDT) From: Zhao Li To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Zhao Li , stable@vger.kernel.org Subject: [PATCH v2] wifi: ieee80211: validate MLE common info length Date: Fri, 12 Jun 2026 01:35:07 +0800 Message-ID: <20260611173506.36838-2-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ieee80211_mle_common_size() uses the first common-info octet as the common information length for all known MLE types. However, ieee80211_mle_size_ok() only validates that octet for Basic, Probe Request, and TDLS MLEs. Reconfiguration MLEs also skipped the length octet when calculating the minimum common size, and Priority Access MLEs skipped validation of the advertised common information length. Account for the Reconfiguration common-info length octet and validate the advertised common information length for all known MLE types. Keep unknown-type handling unchanged. Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element") Cc: stable@vger.kernel.org Signed-off-by: Zhao Li --- include/linux/ieee80211-eht.h | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index a97b1d01f3acf..a557df0088c08 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -844,7 +844,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) const struct ieee80211_multi_link_elem *mle = (const void *)data; u8 fixed = sizeof(*mle); u8 common = 0; - bool check_common_len = false; + u8 common_len; u16 control; if (!data || len < fixed) @@ -855,7 +855,6 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) { case IEEE80211_ML_CONTROL_TYPE_BASIC: common += sizeof(struct ieee80211_mle_basic_common_info); - check_common_len = true; if (control & IEEE80211_MLC_BASIC_PRES_LINK_ID) common += 1; if (control & IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT) @@ -875,9 +874,9 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) common += sizeof(struct ieee80211_mle_preq_common_info); if (control & IEEE80211_MLC_PREQ_PRES_MLD_ID) common += 1; - check_common_len = true; break; case IEEE80211_ML_CONTROL_TYPE_RECONF: + common += 1; if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR) common += ETH_ALEN; if (control & IEEE80211_MLC_RECONF_PRES_EML_CAPA) @@ -889,7 +888,6 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) break; case IEEE80211_ML_CONTROL_TYPE_TDLS: common += sizeof(struct ieee80211_mle_tdls_common_info); - check_common_len = true; break; case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: common = ETH_ALEN + 1; @@ -902,11 +900,10 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) if (len < fixed + common) return false; - if (!check_common_len) - return true; - /* if present, common length is the first octet there */ - return mle->variable[0] >= common; + common_len = mle->variable[0]; + + return common_len >= common && common_len <= len - fixed; } /** -- 2.50.1 (Apple Git-155)