[PATCH] wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok()

[Alexandru Hossu <hossu.alexandru@gmail.com>]

Hi Greg,

Here is the fix.

Alexandru

---

For MLE types with a common_info length field (BASIC, PREQ, TDLS),
ieee80211_mle_size_ok() checks that variable[0] is at least as large as
the mandatory fields, but it does not check that the value fits within
the element itself.

cfg80211_defrag_mle() computes the sub-element area start as:

    common_size = ieee80211_mle_common_size((u8 *)res->mle);
    ie = res->data + common_size;
    ielen = mle_len - common_size;

ieee80211_mle_common_size() returns sizeof(*mle) + mle->variable[0].
If variable[0] is larger than the actual element, common_size exceeds
mle_len and the size_t subtraction wraps. for_each_element_id() then
iterates over arbitrary kernel heap memory past the allocation.

Add the missing upper-bound check so variable[0] cannot exceed the
element size.

Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
 include/linux/ieee80211-eht.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h
index 87d92fb86fab..738a581c3683 100644
--- a/include/linux/ieee80211-eht.h
+++ b/include/linux/ieee80211-eht.h
@@ -908,6 +908,10 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
 	if (!check_common_len)
 		return true;

+	/* common_info length must not exceed the element */
+	if (len < fixed + mle->variable[0])
+		return false;
+
 	/* if present, common length is the first octet there */
 	return mle->variable[0] >= common;
 }