From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C534214A84; Sat, 12 Sep 2026 12:31:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789216313; cv=none; b=eIOMIjyH+6bQYHY6OGJ++7meT8NZJuJuSAr9zrKa8/CUpRdfGDn2uyt7Px+413Rqr+UD0fuvareMVEVAmefsm/zS2zAwBGeZ3VUwvRKEHHpfQ6x0dS7qcrUjqbKoxVLJbpCv11wa6sUm3TQNshvI0H8nDaKCOzkwuo6YQedM8rk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789216313; c=relaxed/simple; bh=jTRQzEgyF3URJIOqNAiLe5VHLReQpX8wWQq2JrYB1jA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dvSc/7g+UxFuHKUM8fONrHqaKL4NT2UB4Z9n9PrKg0mKsouFuJHuUtlUPsuwY6+b4z0Rbyf9TnHC1vL7Znb85SGhLKUOALJxOHGMOuVO6FPYi4WBAQJsb5XlPBnEk8/SP9lxwLM8gc4KNaZlk60stjd/YTUOPj2LBlepb3ay50o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Em72GPd8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Em72GPd8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA9061F000FF; Sat, 12 Sep 2026 12:31:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789216311; bh=ajkn211detQo744HJzhwarz+ZnO9DFTlFqhi8Lr08wQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Em72GPd8dryIhhlO73jHw6oS/TzsYH4O9/LmNBPoxXDPea242YEAWiwJxICJXb/Nq MgrUXIwERg3hi7QtMa4sS1+xSTYWz4rrg7/2cMbZk8fcZ0HZ28IJ+xGyzEtcL1olQo AY2cIMVb8lMf9zVsf2bSFL+pGDElOHGZ/RNSKaoU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Zhao Li , Johannes Berg , Sasha Levin Subject: [PATCH 6.12 0712/1376] wifi: mac80211: fix per-STA profile length in cross-link CSA parsing Date: Sat, 12 Sep 2026 08:52:18 +0200 Message-ID: <20260912065623.412600097@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065607.535295758@linuxfoundation.org> References: <20260912065607.535295758@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zhao Li [ Upstream commit 4a0bd262df757b25fc4e2a53c947317c119ced4e ] ieee80211_mgd_check_cross_link_csa() starts parsing elements after the fixed per-STA profile header and the STA Info field, but subtracts only the STA Info length from the profile length. As a result, ieee802_11_parse_elems() is given sizeof(*prof) == 3 bytes beyond the current profile's element area, and data following the profile may be interpreted as belonging to it. Subtract the fixed profile header as well. The preceding ieee80211_mle_basic_sta_prof_size_ok() check guarantees that the corrected calculation cannot underflow, and ieee80211_rx_uhr_link_reconfig_req() uses the same calculation. The call site currently states that cross-link CSA parsing has no effect because the broader parsing is still incorrect. This patch does not address that broader problem; it only makes the per-STA profile parser stop at the end of that profile. No production allocation over-read or user-visible failure has been demonstrated. Fixes: 7ef8f6821d16 ("wifi: mac80211: mlme: handle cross-link CSA") Assisted-by: Codex:gpt-5.6-sol Assisted-by: Kimi:K3 Signed-off-by: Zhao Li Link: https://patch.msgid.link/20260728111326.63087-1-enderaoelyther@gmail.com Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 38549b5236b84..453801b93c321 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -6660,7 +6660,7 @@ ieee80211_mgd_check_cross_link_csa(struct ieee80211_sub_if_data *sdata, prof = (void *)sta_profiles[link_id]; prof_elems = ieee802_11_parse_elems(prof->variable + (prof->sta_info_len - 1), - len - + len - sizeof(*prof) - (prof->sta_info_len - 1), false, NULL); -- 2.53.0