[PATCH wireless] wifi: brcmfmac: skip beacon fixed fields when parsing SAE PWE rates

[PATCH wireless] wifi: brcmfmac: skip beacon fixed fields when parsing SAE PWE rates

[Zhao Li]

brcmf_parse_configure_sae_pwe() passes settings->beacon.head directly to
brcmf_parse_tlvs() when searching for WLAN_EID_SUPP_RATES, so the 802.11
management header and fixed beacon fields are parsed as elements and
Supported Rates is missed. When BSS_MEMBERSHIP_SELECTOR_SAE_H2E is in
Supported Rates rather than Extended Supported Rates, an H2E-only AP is
configured to accept Hunting-and-Pecking as well.

Skip DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN first, as the SSID
lookup in brcmf_cfg80211_start_ap() already does.

AI assistance was used.

Fixes: f3d9c56e6eb2 ("wifi: brcmfmac: Set extsae_pwe parameter to Infineon firmware in SAP mode")
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
Compile-tested only; no new W=1 GCC/Clang, sparse or smatch warnings.

 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 46714d871260..0c91fdc406bd 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5144,6 +5144,7 @@ brcmf_parse_configure_sae_pwe(struct brcmf_if *ifp,
 	u8 ie_len, i;
 	u32 wpa_auth = 0;
 	u32 sae_pwe = 0; /* 0 = Hunting-and-Pecking only, 1 = H2E only, 2 = both */
+	u32 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
 	s32 err = 0;
 
 	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE_EXT))
@@ -5167,8 +5168,8 @@ brcmf_parse_configure_sae_pwe(struct brcmf_if *ifp,
 	 */
 
 	if (sae_pwe == 2) {
-		supp_rate_ie = brcmf_parse_tlvs((u8 *)settings->beacon.head,
-						settings->beacon.head_len,
+		supp_rate_ie = brcmf_parse_tlvs(settings->beacon.head + ie_offset,
+						settings->beacon.head_len - ie_offset,
 						WLAN_EID_SUPP_RATES);
 		ext_rate_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
 					       settings->beacon.tail_len,

base-commit: 6b4b543fa18757297ac756a6fe6e64f506b7844a
-- 
2.56.0