From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 54CB337F8D3 for ; Tue, 7 Jul 2026 02:53:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783392829; cv=none; b=eXBMGSnB8eMlM5CRsntAVp7d1b+uxDMjgf4nd6S2nvWYZ14o7fvZ8Rbfp0jVvO951p1YOYaFAKpweeBt8rDZAPBx9rbOhYtedvwxg6h7lA9AorqGBYE+1WwojZyJrdEGHmx8AjiyrkKgnJFw/N07KeWMIKxW2SD/WTtdFbpHg7c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783392829; c=relaxed/simple; bh=K26KlvCFcp07s8mYWC/JER2242BAzVb71I3EH4YLOjE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eUGBig+jV2iq/TqNQ0QQ8m8vN6RKn66tKrp00M7VwYUvlSYKC/+uXrg5gV+i6jBrMpXScHRmq/9557Obv2Pi4zHlXUcWjJOimaqsBwZqb6E3qjyZviaDYhQFZ8dXPWHyfHMftIqThcIJ3wwgKfvG1r9l1f7dYGRp5Vg+2EpdqcQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nfmqnGTQ; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nfmqnGTQ" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2cae134bdc8so20273115ad.3 for ; Mon, 06 Jul 2026 19:53:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783392826; x=1783997626; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ST/Uil0tH+wktXYJ7vHGzi8suUAjvLOt6xpdMgK1B2U=; b=nfmqnGTQTve0Hrc/5d/wRkFKgJaTahgTQYGigEZtTDbjacTKq+HeDA3cYedtgm42JA 83h+qjcSOodTMiywJXz122KwTSwuM5VF9zSqK7IgBj5GRlqWd/F+eC0O3ebgMYJZfAzy +V3jUYRFf+I60OFSdmbDG8W28kpZvsLCi0Oz/rcPr35nLUpRAx7+mjEL2hlRh/LDLpcm Vxb24m1hAWb18SYbyIwYWQi4R/KQjNMBh/Ey2lZpuEM/q7WOlj9SNhJ7ipvWbY2GZoOk 8zuR+siwb78mjpL0Jbz3J2BocMFpLoUzO+g6naOrLoVGz5yB/OiML+0FVStCiZXQkLx+ KpKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783392826; x=1783997626; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ST/Uil0tH+wktXYJ7vHGzi8suUAjvLOt6xpdMgK1B2U=; b=KRlBj7tEZfO15OOV2ihftbge2ezji4MP3hVd8/bnV1tEm5TZeD/Evo9SVnyIlyasGE p+6IkQJzngjeLKnE6cALptUqALsU2zAH0qLlm3BZSCWR5O8gGTVGRgo/tSK/8jkY+LIq Rj0N+KONbtu//mLlgR6m06jS6SLQcUbZP+n0G3MC3Zk09A6m+wAOe2GtNegTqQLUQqRl v3nYEilOOZWtiMuTZQP9x6DOFWrE0dHxpzcqaFe6cKUTZiiGHq1z0DSmZFEI3hi4oh4O GCEcQErHO4oCV5qpUMp/XyzoDgodiXYT3TcUX2FrIq/BiqtZd/r3w+1A9bL4CDwS5+XN t7JQ== X-Forwarded-Encrypted: i=1; AHgh+RpepWKRnPYKBLpmwxZz1jjV1mgocwkkgiFCTOItR7z+XsvO1q1I5opp+9yxjqRwwU1yGFbsn1NbAu/Iniw=@vger.kernel.org X-Gm-Message-State: AOJu0Yx+QhJdMKKQ642rguuHcJcRPp6TXOlxedGuJgelCGvSCr9hCOxG /TE2mWl9K14guxW993xCAXVZg0Kc/anVMVz55ObhYMpZ0Y6TQYW7PBnl X-Gm-Gg: AfdE7ck1C5aOUq8vR2Df76bruRmctZMpJop+hxoZgQJCd+4rvLwon1+riPRiuBFMuhD w5I40sTDuOEgwRRSNmbi1Ih8g1uxI/CKidBh1uNZ63VWzuLiIVfKDIj12lrl4ZI8L5rehRs3p2r m+fg1CbCnZfZ880LLUUaZk7fdv0pS/LDOUs2RIoBggxUSU13UG29kkm3g/5J9XV10EddsZMmSGJ FrfZ8GKKxf7ADSbSSY+dcqAn/McJvkE2CUH74d/+MldJNmQM0PR3TgDQrWGKucsHdWueXRp6D8o XDwSW2cfsnYhoh1N9PYy7a6aUhsosOkQ0EDinm5XQWiALMZEQpX1Gfe43erk2twnr79rWFRslYZ xSvnvko3DDqwhdznQhPTzjUveFudJvqZwCHyGoOp4AxwCryavukU8L3j1RdIKm4ZU47+/H6JViE BKPjfDM7GDlv6ZNJbjO5TA2IuWhF+6Dj1S/4bTu+JhdHdZtLMU7A== X-Received: by 2002:a05:6a21:4c0e:b0:3b2:a8cd:ef4a with SMTP id adf61e73a8af0-3c08ee36470mr4075132637.30.1783392825534; Mon, 06 Jul 2026 19:53:45 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([2407:cdc0:606d:ba36:a6c6:36ae:a290:5cf]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f598dsm2755235eec.6.2026.07.06.19.53.43 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 06 Jul 2026 19:53:45 -0700 (PDT) From: Zhao Li To: Johannes Berg Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] wifi: cfg80211: validate assoc response length before status and IE access Date: Tue, 7 Jul 2026 10:53:35 +0800 Message-ID: <20260707025336.22557-2-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260707025336.22557-1-enderaoelyther@gmail.com> References: <488ed9862d5196b8f5ecf23f037fa6725fbe9a52.camel@sipsolutions.net> <20260707025336.22557-1-enderaoelyther@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit cfg80211_rx_assoc_resp() initialises the status and response-IE fields of cfg80211_connect_resp_params from the management frame before proving that the frame is long enough for those offsets. S1G and regular association responses also have different IE offsets, but the S1G path only patched resp_ie after the unsafe initialiser had already run. Defer resp_ie, resp_ie_len, and status to after the link-iteration loop. Use a bool to remember whether the frame is S1G, then validate the appropriate minimum length and set all three fields in a single if/else block. Funnel short-frame and SME-reject cleanup through a shared free_bss label for the abandon paths. Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li --- v2: No change. net/wireless/mlme.c | 56 ++++++++++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 21 deletions(-) diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c index a0f7b08bfcc9c..097b66f758ba2 100644 --- a/net/wireless/mlme.c +++ b/net/wireless/mlme.c @@ -32,14 +32,10 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, .timeout_reason = NL80211_TIMEOUT_UNSPECIFIED, .req_ie = data->req_ies, .req_ie_len = data->req_ies_len, - .resp_ie = mgmt->u.assoc_resp.variable, - .resp_ie_len = data->len - - offsetof(struct ieee80211_mgmt, - u.assoc_resp.variable), - .status = le16_to_cpu(mgmt->u.assoc_resp.status_code), .ap_mld_addr = data->ap_mld_addr, }; unsigned int link_id; + bool is_s1g = false; for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { cr.links[link_id].status = data->links[link_id].status; @@ -60,16 +56,32 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, if (cr.links[link_id].bss->channel->band == NL80211_BAND_S1GHZ) { WARN_ON(link_id); - cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable; - cr.resp_ie_len = data->len - - offsetof(struct ieee80211_mgmt, - u.s1g_assoc_resp.variable); + is_s1g = true; } if (cr.ap_mld_addr) cr.valid_links |= BIT(link_id); } + if (is_s1g) { + if (data->len < offsetof(struct ieee80211_mgmt, + u.s1g_assoc_resp.variable)) + goto free_bss; + cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable; + cr.resp_ie_len = data->len - + offsetof(struct ieee80211_mgmt, + u.s1g_assoc_resp.variable); + } else { + if (data->len < offsetof(struct ieee80211_mgmt, + u.assoc_resp.variable)) + goto free_bss; + cr.resp_ie = mgmt->u.assoc_resp.variable; + cr.resp_ie_len = data->len - + offsetof(struct ieee80211_mgmt, + u.assoc_resp.variable); + } + cr.status = le16_to_cpu(mgmt->u.assoc_resp.status_code); + trace_cfg80211_send_rx_assoc(dev, data); /* @@ -78,22 +90,24 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, * and got a reject -- we only try again with an assoc * frame instead of reassoc. */ - if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) { - for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { - struct cfg80211_bss *bss = data->links[link_id].bss; - - if (!bss) - continue; - - cfg80211_unhold_bss(bss_from_pub(bss)); - cfg80211_put_bss(wiphy, bss); - } - return; - } + if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) + goto free_bss; nl80211_send_rx_assoc(rdev, dev, data); /* update current_bss etc., consumes the bss reference */ __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS); + return; + +free_bss: + for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { + struct cfg80211_bss *bss = data->links[link_id].bss; + + if (!bss) + continue; + + cfg80211_unhold_bss(bss_from_pub(bss)); + cfg80211_put_bss(wiphy, bss); + } } EXPORT_SYMBOL(cfg80211_rx_assoc_resp); -- 2.50.1 (Apple Git-155)