RE: [PATCH wireless v2 2/2] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

[Ping-Ke Shih <pkshih@realtek.com>]

Tristan Madani <tristmd@gmail.com> wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> __rtw89_wow_parse_akm() computes a pointer to the IE area from an
> association request frame:
> 
>     ies = mgmt->u.assoc_req.variable;
> 
> but then passes skb->len as the IE data length to cfg80211_find_ie().
> Since skb->len covers the entire frame including the 28-byte management
> header and fixed fields, cfg80211_find_ie() may read past the end of the
> actual IE data.
> 
> Fix by computing the correct IE data length as skb->len minus the
> header offset, and validating the minimum frame length before parsing.
> 
> Fixes: 480dd4dddfc5 ("wifi: rtw89: enter power save mode aggressively")

it should be

Fixes: 92790c4e50d2 ("wifi: rtw89: wow: parsing Auth Key Management from associate request")

> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Acked-by: Ping-Ke Shih <pkshih@realtek.com>