Re: [PATCH wireless 3/3] wifi: p54: fix IE parsing loop bounds check

[Johannes Berg <johannes@sipsolutions.net>]

On Mon, 2026-10-26 at 11:21 +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> p54_find_ie() iterates over information elements using a loop condition
> of while (pos < end). When only one byte remains (pos == end - 1),
> the loop body accesses pos[1] which reads one byte beyond the validated
> buffer boundary. The read happens in the bounds check expression
> pos + 2 + pos[1] > end before the result of that check can prevent
> the access.
> 
> Fix by tightening the loop condition to while (pos + 2 <= end),
> which ensures that at least the IE id (pos[0]) and length (pos[1])
> bytes are within bounds before any access.
> 
> Fixes: 0ac0d6cedf611 ("p54: Move mac80211 glue code")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/net/wireless/intersil/p54/main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
> index 57a62108cbc35..16614f65dfa5f 100644
> --- a/drivers/net/wireless/intersil/p54/main.c
> +++ b/drivers/net/wireless/intersil/p54/main.c
> @@ -81,7 +81,7 @@ u8 *p54_find_ie(struct sk_buff *skb, u8 ie)

We'd probably be better off just replacing that whole function with one
of the real search functions or iteration macros?

johannes