Syzkaller reported a KASAN slab-out-of-bounds read in skip_ie()
and a fortify memcpy panic in cfg80211_sme_get_conn_ies().

The KASAN allocation trace shows that a malformed IE buffer is
stored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any
validation. The crash trace shows that a subsequent SIOCSIWESSID
triggers a connection attempt which calls cfg80211_sme_get_conn_ies()
to process the stored IE buffer, causing:

 - An out-of-bounds read in skip_ie() which reads ies[pos+1]
   (the length byte) past the end of the 1-byte buffer.

 - An integer underflow in the memcpy size argument when offs
   returned by ieee80211_ie_split() exceeds ies_len, causing
   unsigned subtraction to wrap to SIZE_MAX and triggering a
   fortify panic.

Fix this by validating the IE buffer in cfg80211_wext_siwgenie()
before storing it. Add cfg80211_validate_ies() which walks the
buffer and verifies every element has at least 2 bytes (type +
length) and sufficient data bytes as indicated by its length
field. Return -EINVAL if validation fails.

Reported-by: syzbot+cc867e537e4bd36f69bb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cc867e537e4bd36f69bb
Tested-by: syzbot+cc867e537e4bd36f69bb@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 include/net/cfg80211.h  |  1 +
 net/wireless/util.c     | 16 ++++++++++++++++
 net/wireless/wext-sme.c |  2 ++
 3 files changed, 19 insertions(+)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8188ad200de5..32cef926f8a4 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -10992,4 +10992,5 @@ void cfg80211_incumbent_signal_notify(struct wiphy *wiphy,
 				      u32 signal_interference_bitmap,
 				      gfp_t gfp);
 
+bool cfg80211_validate_ies(const u8 *ies, size_t ies_len);
 #endif /* __NET_CFG80211_H */
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 24527bf321b2..a685020c8efc 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -3083,3 +3083,19 @@ bool cfg80211_wdev_channel_allowed(struct wireless_dev *wdev,
 	return false;
 }
 EXPORT_SYMBOL(cfg80211_wdev_channel_allowed);
+
+bool cfg80211_validate_ies(const u8 *ies, size_t ies_len)
+{
+	size_t pos = 0;
+
+	while (pos < ies_len) {
+		if (pos + 2 > ies_len)
+			return false;
+		if (pos + 2 + ies[pos + 1] > ies_len)
+			return false;
+		pos += 2 + ies[pos + 1];
+	}
+
+	return true;
+}
+EXPORT_SYMBOL(cfg80211_validate_ies);
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 573b6b15a446..3e9b071f6d66 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -319,6 +319,8 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
 		return 0;
 
 	if (ie_len) {
+		if (!cfg80211_validate_ies(extra, ie_len))
+			return -EINVAL;
 		ie = kmemdup(extra, ie_len, GFP_KERNEL);
 		if (!ie)
 			return -ENOMEM;
-- 
2.43.0

On Fri, 2026-07-10 at 08:16 +0530, Deepanshu Kartikey wrote:
> 
> +bool cfg80211_validate_ies(const u8 *ies, size_t ies_len)
> +{
> +	size_t pos = 0;
> +
> +	while (pos < ies_len) {
> +		if (pos + 2 > ies_len)
> +			return false;
> +		if (pos + 2 + ies[pos + 1] > ies_len)
> +			return false;
> +		pos += 2 + ies[pos + 1];
> +	}
> +
> +	return true;
> +}
> +EXPORT_SYMBOL(cfg80211_validate_ies);

I don't believe you'd need to even export this, and we also already have
validate_ie_attr() in nl80211, written in a better way too...

johannes

On Fri, Jul 10, 2026 at 12:09 PM Johannes Berg
<johannes@sipsolutions.net> wrote:
>

> I don't believe you'd need to even export this, and we also already have
> validate_ie_attr() in nl80211, written in a better way too...
>
> johannes

Hi Johannes,

validate_ie_attr() takes a struct nlattr * but the wext path
works with a raw char * buffer, so it cannot be called directly.

I have reused the same approach using for_each_element() and
for_each_element_completed() instead. Is this acceptable?

Thanks

Deepanshu

Hi,

Sorry for the delay.

On Fri, 2026-07-10 at 21:01 +0530, Deepanshu Kartikey wrote:
> 
> validate_ie_attr() takes a struct nlattr * but the wext path
> works with a raw char * buffer, so it cannot be called directly.

Oops, right.

> I have reused the same approach using for_each_element() and
> for_each_element_completed() instead. Is this acceptable?

Sounds good!

johannes