From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F2331A38F9 for ; Fri, 12 Jun 2026 18:50:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781290254; cv=none; b=MEEa/3vFkJYwsu1Z5924/SLefneVDw7UZ5p9KQBJp5Wdk7ywceAXaCFyWM07cwketw29TFOGksd0calHaIgOmR9Fwxb2ZOz0jjMo2MXdE6M2l23waDBQ0upsvkGIUEGeP47MbsrdXrt6ibQCYi5BbnKHTA97s5Ct9bYaEQjEpBE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781290254; c=relaxed/simple; bh=zqdxczSfCDR24qK8RchijXOYco+66PeeGVmmOB0l8Fk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cLMPiOkyfqsqwVyzyXI9vU+zujoF2n4+t0+I16SHEOR7YLe5lIc6QPk/iOnP0ZcsNv20+3ePPHWZ8ikvyO9hy+7+dtUvvoQLPp3POSS2NMhjbIaAgl5l7TlmX3HmXew6fvp1bSJDxnPHig8SMcTaCA4jFNizSCbfGRE3vJLoHtk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=olTTVOLa; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="olTTVOLa" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2c0b944f6edso13669015ad.2 for ; Fri, 12 Jun 2026 11:50:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781290252; x=1781895052; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=5TDQxnXyG/6WR12CZ2iRyY55tbEMYwWbeoypsoM106w=; b=olTTVOLa1MdVRpoXpCY3QdGjxZcyY83UUjSiJ60AsQuC/Q2CY/hBXvM/OfFSrvZS5p 2bDuHLuAlxAevbdQKVXfGvRNc3ZhKapVa6dSC+dzwtB0tnMRNBWmrfCvIvQwy/f58LVJ IuZtprPnck72OgnBV3KyGcTxvL/llfWvXY4Awkh0AyJ4klKSrcZm2XbSajBTtyCvRogC tJ+6jzHnXgVzsC4CixSrsYpKjVGmBiPRq/X4dt/77T7yC7jVUFQQX+zilUARCGa1ZCPV agNlUB+h6UGpLle8ExZ/++bJrGSZACrJ2lCPJmbza8puAgVJ/ycfgwHbWFGYS6WjyWAD QVKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781290252; x=1781895052; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=5TDQxnXyG/6WR12CZ2iRyY55tbEMYwWbeoypsoM106w=; b=apdrmkkuOkvpac/j6KPfwiL0z/38CrogVLtETyWxw7ixnvyVy8fPjCtXTDi0bcB0Wl vrWQpjzP525BB8pKEu/2SR5T7lqELfMQ5+w+JflOuMCFfyzFi5o8jAxqEVBw70J1H82k nZvTiUzynHqHkpacdEOfAzahjh/5jhQfQHCgzkZD+76vmJSRr59LF6HOK+36PiLTz1f7 6Ej0LAhMNqSHgC+t2wF3lE+1fipWlb9hRY4nj9ZbBpTUAZVduxqrjMz1L6+3AIX2ZJW2 mP0qSBoSS1sHwIbssTIvAKnM6wV1tyTSo54cBLD5MRhoMa3RaGUF0hyWwPxbqhWsINPy PPtA== X-Forwarded-Encrypted: i=1; AFNElJ+YD0zJRhhmYav5GfOVoI/e7BvL4eG1dulWyGhqoTYv8k+Rjx3NwamEYb3M9CxiamPm6TTazlbbznylSGs=@vger.kernel.org X-Gm-Message-State: AOJu0YygYAQEPsp+30oqovEw9J6sbBS/7k4+x5fR0jBE++vNyS8DhxRK XAl2YrgTPBocpgTnvAzfQVcAbFwmxTyVHxSogOJWePBoSCAfKopnD8hFFyIVvbEkKwywbw== X-Gm-Gg: Acq92OHGlWcRCUq5EJvIAGvhMMbmDbe3Ay3+jZILuXwImYSBbUIXtbr8DvdQYFWF2Rj +kyYLwtoat6hSHEPLZtFTEkSJzmZhnBzrnKfGq9C64D7Q/I3KRiaC+IN33A7OzYdJdgiFP0MYvy Mf4MVJ1Q/L42yqoctnM1oCj1qsWosy/+j28P5rVavT3DFWgS5o8IWqz3nmhzICZtKEFyyoC+UpE R0eNMSsIUCzUAtZwY8m1V+KaJLZ16D6cRAPxpQt0GMIDDo0SLDzrWGF0rZDJ5fFP2kQBDInfVSq AVoQ0PARo+0OhLUrOiN8tSkKedoRjfwMMROv6FJhXYO9emTv2vHAo8NALSdnRuS0R4kOPOO+F9F 36NMZFmBRxcnPE8qi7UOQYH3Ezkh7uzP4cxuZllZ1W+D/kk6QzhBlEOEFZZFISEyjITto7/YjOo rH6FIIhg6i9//NH9eEzRthIymOAotQlfSY0lmzzYQteyAXzoOuKiBnO98jObJnU2o= X-Received: by 2002:a17:903:fb0:b0:2c1:d49c:8396 with SMTP id d9443c01a7336-2c6641987dbmr10454145ad.1.1781290251880; Fri, 12 Jun 2026 11:50:51 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([139.177.225.248]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c432d8a039sm28464465ad.62.2026.06.12.11.50.49 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 12 Jun 2026 11:50:51 -0700 (PDT) From: Zhao Li To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/3] wifi: cfg80211: validate assoc response length before status and IE access Date: Sat, 13 Jun 2026 02:50:44 +0800 Message-ID: <20260612185042.66260-5-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260612185042.66260-4-enderaoelyther@gmail.com> References: <20260612185042.66260-4-enderaoelyther@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit cfg80211_rx_assoc_resp() initialises the status and response-IE fields of cfg80211_connect_resp_params from the management frame before proving that the frame is long enough for those offsets. S1G and regular association responses also have different IE offsets, but the S1G path only patched resp_ie after the unsafe initialiser had already run. Defer resp_ie, resp_ie_len, and status to after the link-iteration loop. Use a bool to remember whether the frame is S1G, then validate the appropriate minimum length and set all three fields in a single if/else block. Funnel short-frame and SME-reject cleanup through a shared free_bss label for the abandon paths. Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li --- net/wireless/mlme.c | 56 ++++++++++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 21 deletions(-) diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c index a0f7b08bfcc9c..097b66f758ba2 100644 --- a/net/wireless/mlme.c +++ b/net/wireless/mlme.c @@ -32,14 +32,10 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, .timeout_reason = NL80211_TIMEOUT_UNSPECIFIED, .req_ie = data->req_ies, .req_ie_len = data->req_ies_len, - .resp_ie = mgmt->u.assoc_resp.variable, - .resp_ie_len = data->len - - offsetof(struct ieee80211_mgmt, - u.assoc_resp.variable), - .status = le16_to_cpu(mgmt->u.assoc_resp.status_code), .ap_mld_addr = data->ap_mld_addr, }; unsigned int link_id; + bool is_s1g = false; for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { cr.links[link_id].status = data->links[link_id].status; @@ -60,16 +56,32 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, if (cr.links[link_id].bss->channel->band == NL80211_BAND_S1GHZ) { WARN_ON(link_id); - cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable; - cr.resp_ie_len = data->len - - offsetof(struct ieee80211_mgmt, - u.s1g_assoc_resp.variable); + is_s1g = true; } if (cr.ap_mld_addr) cr.valid_links |= BIT(link_id); } + if (is_s1g) { + if (data->len < offsetof(struct ieee80211_mgmt, + u.s1g_assoc_resp.variable)) + goto free_bss; + cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable; + cr.resp_ie_len = data->len - + offsetof(struct ieee80211_mgmt, + u.s1g_assoc_resp.variable); + } else { + if (data->len < offsetof(struct ieee80211_mgmt, + u.assoc_resp.variable)) + goto free_bss; + cr.resp_ie = mgmt->u.assoc_resp.variable; + cr.resp_ie_len = data->len - + offsetof(struct ieee80211_mgmt, + u.assoc_resp.variable); + } + cr.status = le16_to_cpu(mgmt->u.assoc_resp.status_code); + trace_cfg80211_send_rx_assoc(dev, data); /* @@ -78,22 +90,24 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, * and got a reject -- we only try again with an assoc * frame instead of reassoc. */ - if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) { - for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { - struct cfg80211_bss *bss = data->links[link_id].bss; - - if (!bss) - continue; - - cfg80211_unhold_bss(bss_from_pub(bss)); - cfg80211_put_bss(wiphy, bss); - } - return; - } + if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) + goto free_bss; nl80211_send_rx_assoc(rdev, dev, data); /* update current_bss etc., consumes the bss reference */ __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS); + return; + +free_bss: + for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { + struct cfg80211_bss *bss = data->links[link_id].bss; + + if (!bss) + continue; + + cfg80211_unhold_bss(bss_from_pub(bss)); + cfg80211_put_bss(wiphy, bss); + } } EXPORT_SYMBOL(cfg80211_rx_assoc_resp); -- 2.50.1 (Apple Git-155)