From nobody Wed Dec 17 04:37:18 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBD42C433FE for ; Thu, 13 Oct 2022 17:55:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230091AbiJMRzg (ORCPT ); Thu, 13 Oct 2022 13:55:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54808 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229889AbiJMRyY (ORCPT ); Thu, 13 Oct 2022 13:54:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9EF9114FD27; Thu, 13 Oct 2022 10:53:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A476AB82022; Thu, 13 Oct 2022 17:53:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 19B77C433C1; Thu, 13 Oct 2022 17:53:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665683624; bh=4i4bGpQbrfxPFjyQlwZKPo4OoBFe09RvpTK42I5SAjU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0XbWywXVsN+Gf1BTrUCoUCFtlATFigIIt3bAMi1/I2MszT+5PS0js8qLk3MwhbzX/ Xb4kaw5H8l7L4zA9ckR+o10iR8K/WGS/WwPgCHdxhQwqNQQ6aRVqohaD+KbWxCLt1C ItCgd6VIGlMFwoG7RLIiXDb8XSNAasUZYbeZvr5A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Soenke Huster , Johannes Berg Subject: [PATCH 5.4 32/38] wifi: cfg80211: ensure length byte is present before access Date: Thu, 13 Oct 2022 19:52:33 +0200 Message-Id: <20221013175145.309108696@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175144.245431424@linuxfoundation.org> References: <20221013175144.245431424@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johannes Berg commit 567e14e39e8f8c6997a1378bc3be615afca86063 upstream. When iterating the elements here, ensure the length byte is present before checking it to see if the entire element will fit into the buffer. Longer term, we should rewrite this code using the type-safe element iteration macros that check all of this. Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in sc= anning") Reported-by: Soenke Huster Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/scan.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -265,7 +265,8 @@ static size_t cfg80211_gen_new_ie(const tmp_old =3D cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); tmp_old =3D (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie; =20 - while (tmp_old + tmp_old[1] + 2 - ie <=3D ielen) { + while (tmp_old + 2 - ie <=3D ielen && + tmp_old + tmp_old[1] + 2 - ie <=3D ielen) { if (tmp_old[0] =3D=3D 0) { tmp_old++; continue; @@ -325,7 +326,8 @@ static size_t cfg80211_gen_new_ie(const * copied to new ie, skip ssid, capability, bssid-index ie */ tmp_new =3D sub_copy; - while (tmp_new + tmp_new[1] + 2 - sub_copy <=3D subie_len) { + while (tmp_new + 2 - sub_copy <=3D subie_len && + tmp_new + tmp_new[1] + 2 - sub_copy <=3D subie_len) { if (!(tmp_new[0] =3D=3D WLAN_EID_NON_TX_BSSID_CAP || tmp_new[0] =3D=3D WLAN_EID_SSID)) { memcpy(pos, tmp_new, tmp_new[1] + 2);