From nobody Sun Jul 26 01:45:55 2026 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70E9D4908A9 for ; Sat, 25 Jul 2026 14:20:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784989238; cv=none; b=CQrWH70apGZJl0D5ofnDc0aj9Q5DxKw+YbnNnVx8tg5NIzde5B6W91HWgnAx4hg3O7IvZiU8o8aXOa+2KGzqnHL6ks+je878AGqK4Ly4Ca2cDtRyJjKKmVj4JU0L3gjVRCmY0shpaKpGRkCw/kzZemhZKh96pXtBkPx+y4nLXnE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784989238; c=relaxed/simple; bh=vF/EZxMH4ith7H/T/Ifl0fk3k439bUBG4mpWJtmX8Lc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=d15MQS0iFpQ1dI1b/6LtuenUQMzxy0UdM0nMUuHMM16ihmCtjo1reeUzPXiX7U7BxkYSRZ3TE6++ZRZcLx14nZekhUamLvFuRXVDiNWeTfhpnsExPRBGDkDMMoBvAOK9XMdPBOKUuJdioEYsMXPJSRCBaW73VAYFwQr5x+P5XDM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LDpALPrX; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LDpALPrX" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2cae1a3a744so10238445ad.3 for ; Sat, 25 Jul 2026 07:20:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784989237; x=1785594037; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=dx1yo+iIXIjXTyWIGQd/i3LQYtj6TWfZYRYFmYaTjBE=; b=LDpALPrX/+/2FLs6yQXQaOAl/jb90TxGHal2w+r/RK24ezPy41cc9SruqNL97su69T Q/PijZTK+oF8OejxUI04ZncdZxvR6AB12PJYRWb4hsfDzCMTMkgWA7nFnU1/KOnjg6O1 llC6NFvwaQ9gZ+L3e6STIuossfRn8CTxSYiNBUpj6uiG46MEgSDvUsHu37HJYBmiLEAn 5MGdR6e70IEwpb32m+LqvNJ0OgzP5lUDrjtiRgBLmu17Nerhupy6NrOOuaEF+9lv+LO0 31j4K6TmfAmDaPzZs15IU6H/jp1Zg9WocHdIgAmUc5B6JtxPqGHyxBBY0yZheVPqHCx1 nmrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784989237; x=1785594037; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dx1yo+iIXIjXTyWIGQd/i3LQYtj6TWfZYRYFmYaTjBE=; b=BD+RgTnAFHBTskuNffIyRrjdKnVPQtqZbGltxQIm1f8+GPpw/obQUyypfy8K/EmaCi sprQay9q/yDAMqcNLd6d8+SkBAyd9b6r7LptWzhmHvjn/GKv2YszfTS8W2CcFyJ+3bqH 6nxm7FdKaJW1t/romqhSWIMYGdnmbWZudaoBSH93gh/lm/exp+bOrsd2cCe4zTcUhqi+ 3GCMwQ14DfWfN/L57KpyE2Gno93J+L3Kvzm9nmCXZhaUkaWvp/fIbPYkHyGFeGyaJm75 ZJWq6+RX56j+FpvKwfKyRFAnIopjqwLwgsD9mZXKDpqhs7g6hkI8LmD1Dx+sOWHvmyXF 8mMw== X-Forwarded-Encrypted: i=1; AHgh+RoH0BiGGk58awWRqWBkCJVdTN7eYe4qUBBzBXxfc6slz/92NYzJXMcIfka3jzfSJAE4IJoJodh0A1kTubY=@vger.kernel.org X-Gm-Message-State: AOJu0YwXJrxohSrlveFEesSj2wzo66pNlI0FY/XtQg2oLyCtQaONVZeM xeL1XTXBoO8dXWwSl1YgLDJUVV1QgcNdIV6R2ETLCkJGL4Uf3RL9Z1Qt+K7vyQ== X-Gm-Gg: AR+sD13Z25By8wKOcdUZW+HbINHkUDGHzs8aUH1vfU4eIk37fHtaCONU2kaqSxn3MOx Pq5/y4xCE0LyGL2zkznbXI603cAchyV/NktoaP/HGayLnX7wPNqWfs1R2u7wdFFGPmroDr/u1Yj OunlkM8EBeVZP5QtddZ2PzDe02ddfg8asaCPbwi2f3/DVsyMyokhuEbCh+SU+35VfXaI330Vm7I FVoK5te2OO4h9z3QS6kcn/rObTqpgExugrdD/2yYk72zUgvrkqnz+4ERFg287jh5XSAwNmmwkqO sVOUXvqfcSFkCqWNwZjefObIhuYQkB+MR0iTdJWYquFsv2+3tLMzQFN0lToDYQzXYX3X7SHpL7Y EK10SZF11YTZJDJ7O7YFUKIq29SqHpoeTfx2pGn0+50Ai8clOqcii2ik08qOfC68t2vBLMngEbJ YUyCYrKlLi1Obud+OsJpIZwyuGSMza/vYmzc010KVThaAJUib+NHP79HdD X-Received: by 2002:a17:903:1a27:b0:2cf:8131:75f4 with SMTP id d9443c01a7336-2cfde7aa812mr22476235ad.11.1784989236717; Sat, 25 Jul 2026 07:20:36 -0700 (PDT) Received: from deepanshu-kernel-hacker.. ([2405:201:682f:383f:14e7:a09f:23fb:cb4]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-314bc549cacsm11412873eec.16.2026.07.25.07.20.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 25 Jul 2026 07:20:35 -0700 (PDT) From: Deepanshu Kartikey To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+cc867e537e4bd36f69bb@syzkaller.appspotmail.com Subject: [PATCH v2] wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() Date: Sat, 25 Jul 2026 19:50:28 +0530 Message-ID: <20260725142028.32560-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any validation. The crash trace shows that a subsequent SIOCSIWESSID triggers a connection attempt which calls cfg80211_sme_get_conn_ies() to process the stored IE buffer, causing: - An out-of-bounds read in skip_ie() which reads ies[pos+1] (the length byte) past the end of the 1-byte buffer. - An integer underflow in the memcpy size argument when offs returned by ieee80211_ie_split() exceeds ies_len, causing unsigned subtraction to wrap to SIZE_MAX and triggering a fortify panic. Fix this by validating the IE buffer in cfg80211_wext_siwgenie() before storing it. First reject buffers smaller than 2 bytes since a valid IE requires at least a type and length field. Then use for_each_element() and for_each_element_completed() to verify all elements are well-formed. Return -EINVAL if validation fails. Reported-by: syzbot+cc867e537e4bd36f69bb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dcc867e537e4bd36f69bb Signed-off-by: Deepanshu Kartikey --- v2: Use for_each_element() and for_each_element_completed() instead of open-coded validation loop, as suggested by Johannes Berg. Also add explicit ie_len < 2 check to handle the case where for_each_element_completed() returns true for a 1-byte buffer. --- net/wireless/wext-sme.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c index 573b6b15a446..51fc2617a1c3 100644 --- a/net/wireless/wext-sme.c +++ b/net/wireless/wext-sme.c @@ -319,6 +319,18 @@ int cfg80211_wext_siwgenie(struct net_device *dev, return 0; =20 if (ie_len) { + const struct element *elem; + + /* IE must have at least Type + Length bytes */ + if (ie_len < 2) + return -EINVAL; + for_each_element(elem, extra, ie_len) { + /* nothing */ + } + + if (!for_each_element_completed(elem, extra, ie_len)) + return -EINVAL; + ie =3D kmemdup(extra, ie_len, GFP_KERNEL); if (!ie) return -ENOMEM; --=20 2.43.0