From 3749c7c7c75fd7fe70f96a1779eee129ec1975a6 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 24 Jul 2024 13:29:12 +0200 Subject: [PATCH] wifi: cfg80211: correct S1G beacon length calculation BugLink: https://bugs.launchpad.net/bugs/2083488 [ Upstream commit 6873cc4416078202882691b424fcca5b5fb1a94d ] The minimum header length calculation (equivalent to the start of the elements) for the S1G long beacon erroneously required only up to the start of u.s1g_beacon rather than the start of u.s1g_beacon.variable. Fix that, and also shuffle the branches around a bit to not assign useless values that are overwritten later. Reported-by: syzbot+0f3afa93b91202f21939@syzkaller.appspotmail.com Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results") Link: https://patch.msgid.link/20240724132912.9662972db7c1.I8779675b5bbda4994cc66f876b6b87a2361c3c0b@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin [koichiroden: adjusted context due to missing upstream commits: 317bad4c3b61 ("wifi: cfg80211: remove cfg80211_inform_single_bss_frame_data()") 7e899c1d6f0d ("wifi: cfg80211: clean up cfg80211_inform_bss_frame_data()")] Signed-off-by: Koichiro Den Signed-off-by: Roxana Nicolescu --- net/wireless/scan.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 64295217b6ad..5dd5119faf6e 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -3121,8 +3121,7 @@ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy, struct ieee80211_ext *ext = NULL; u8 *bssid, *variable; u16 capability, beacon_int; - size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt, - u.probe_resp.variable); + size_t ielen, min_hdr_len; int bss_type; BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) != @@ -3142,10 +3141,16 @@ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy, if (ieee80211_is_s1g_beacon(mgmt->frame_control)) { ext = (void *) mgmt; - min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon); if (ieee80211_is_s1g_short_beacon(mgmt->frame_control)) min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_short_beacon.variable); + else + min_hdr_len = offsetof(struct ieee80211_mgmt, + u.probe_resp.variable); + } else { + /* same for beacons */ + min_hdr_len = offsetof(struct ieee80211_mgmt, + u.probe_resp.variable); } if (WARN_ON(len < min_hdr_len))