[PATCH] wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok()

[PATCH] wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok()

[Alexandru Hossu]

Hi Greg,

Here is the fix.

Alexandru

---

For MLE types with a common_info length field (BASIC, PREQ, TDLS),
ieee80211_mle_size_ok() checks that variable[0] is at least as large as
the mandatory fields, but it does not check that the value fits within
the element itself.

cfg80211_defrag_mle() computes the sub-element area start as:

    common_size = ieee80211_mle_common_size((u8 *)res->mle);
    ie = res->data + common_size;
    ielen = mle_len - common_size;

ieee80211_mle_common_size() returns sizeof(*mle) + mle->variable[0].
If variable[0] is larger than the actual element, common_size exceeds
mle_len and the size_t subtraction wraps. for_each_element_id() then
iterates over arbitrary kernel heap memory past the allocation.

Add the missing upper-bound check so variable[0] cannot exceed the
element size.

Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
 include/linux/ieee80211-eht.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h
index 87d92fb86fab..738a581c3683 100644
--- a/include/linux/ieee80211-eht.h
+++ b/include/linux/ieee80211-eht.h
@@ -908,6 +908,10 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
 	if (!check_common_len)
 		return true;

+	/* common_info length must not exceed the element */
+	if (len < fixed + mle->variable[0])
+		return false;
+
 	/* if present, common length is the first octet there */
 	return mle->variable[0] >= common;
 }

Re: [PATCH] wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok()

[Greg KH]

On Fri, May 15, 2026 at 03:42:04AM -0700, Alexandru Hossu wrote:
> Hi Greg,
> 
> Here is the fix.

Context matters :)

Also, this isn't in a mergable format, please take a look at the kernel
documentation for how to do this properly.

thanks,

greg k-h

Re: [PATCH] wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok()

[Alexandru Hossu]

On Fri, May 15, 2026 at 01:36:03PM +0200, Greg KH wrote:
> Context matters :)
> Also, this isn't in a mergable format, please take a look at the kernel
> documentation for how to do this properly.

Sorry for both issues. The greeting was wrong, the format was wrong,
and most importantly I didn't check the tree first -- the fix is
already at ieee80211-eht.h:912 in linux-next. I wasted your time.

Withdrawing this.

Alexandru