nxpwifi_update_bss_desc_with_ie() dispatches on elem->data[0] for
WLAN_EID_EXTENSION without checking that the element has a payload.
A well-formed extension element carries at least the element ID
extension byte, but nothing enforces that in the IE stream, and the
loop accepts a zero-length element because its header alone fits.
elem->data[0] then reads the byte after the element, which is past the
kmemdup()ed IE buffer when that element ends the stream.
Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
drivers/net/wireless/nxp/nxpwifi/scan.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/nxp/nxpwifi/scan.c b/drivers/net/wireless/nxp/nxpwifi/scan.c
index bb3ce2b6f4b9..b77056983e83 100644
--- a/drivers/net/wireless/nxp/nxpwifi/scan.c
+++ b/drivers/net/wireless/nxp/nxpwifi/scan.c
@@ -1255,6 +1255,9 @@ int nxpwifi_update_bss_desc_with_ie(struct nxpwifi_adapter *adapter,
(u16)(current_ptr - bss_entry->beacon_buf);
break;
case WLAN_EID_EXTENSION:
+ if (!element_len)
+ return -EINVAL;
+
elem = (struct element *)current_ptr;
switch (elem->data[0]) {
--
2.25.1