From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D581A3FB7E7 for ; Fri, 26 Jun 2026 14:45:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782485157; cv=none; b=Vxh2BiACMlJGfUf3uo/NmbJtQr0K4qWkX3Y5DovWGrmwLFEZGc1Le20X8AhrEnKV7LF3zCRy7XNpyiG7L4S60O650Gi2R9WoVIr9UFOsZrkCYYJ/iSR1zQd0uSngrqFFkDtGS4SjT2ReHAaBx8V391X2rlCCQwEjMjtJnMH3tv0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782485157; c=relaxed/simple; bh=AX9U9xN8wChIazxZOxRR5JpD5zZhzI3DYw3FyKRANos=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=glTG9y0Uk4ZlQaRrLPJ8bOvAumRSasb6goNkko9N076gtoC5VPOl/l4TScx4XBPlFKei4ChTLTBNrdArFjJ/57nyMXBZBOYS4uSEi/eenrVy2p2yoQgGdo5JMqBzcQOaNP8TgOi2CWeU9G/aDaJxRcIBi6MsVHi8qikJ+vpCoiE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ep/hAuDi; arc=none smtp.client-ip=209.85.215.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ep/hAuDi" Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-c88a4d79ba5so659208a12.2 for ; Fri, 26 Jun 2026 07:45:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782485152; x=1783089952; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=WdZSOi53dmzzj+BLCmkfJMdj4VvvOVoGTQDT9HDmFKM=; b=ep/hAuDi+SYRr5EFzdLF9H1La3mdtzdCnLbD4eaYAed2WEKs8uzX/CoSv1Zj6TdwRK KCNPo7HThUTBO8/0kjBx3pBMhdE/QwaEGRqWpnyjX3FZSzetliYp2Mae4CrJVbjapkss InswdOCGSEYrIRBrxOSnJSnAYpftxAy4+O1JEUN9zZSA1jbQUbleXTpSxv+f3jY6gOeY MbNWyEiHIknFmetQSg5j2XBAEC+dVb/ETas/N3meIlNanyUP7hUwxLcUAA0LbrsLvm5O fnwOvd4zRdRhVR1+eu550f6GOlrERyeDZegnQC/OuRkQNvClz9XIbCmqIB5jFEJXt749 Yl+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782485152; x=1783089952; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=WdZSOi53dmzzj+BLCmkfJMdj4VvvOVoGTQDT9HDmFKM=; b=rM8WCXf7qKDvspTXsRSFYtN3FfcU6DHTcZkvLWPsXh95MMRngngdloIVb5q8synPFa nCO6iaD6DEaGr2ySANz2M/Y1NMh7G6byiY/i4ejHOL3UqBfcN7XwuRegJ+Vs8RcDIorX tSJiXbsu6yztNluwxCc2ChgIbpsPYHddZl1nVaDvKGODvWt4miiWC/muimhXK14keG/A 3abaLzgJFNF9fZ4n73UAzXe6Ew5Fq03Q+YJUhAmlgNLdmOQsMAG2JlKriKLXekjxIfy/ 7WFw4VnC/1RFWbs5kqljuEiQpq6kjHMSVWzry551VbrBtbGsp28o9mLoQHHBZ+TdiyV/ JrXw== X-Forwarded-Encrypted: i=1; AHgh+RoQ7pzI6scC8cYkOP39ASCXXeSXLnH3425elhNJg4NKs+UeaSW30itPTETXRWISPIgUBXNUaqYTU6xxjh8=@vger.kernel.org X-Gm-Message-State: AOJu0YyyZHJWRtKh+crA4jHPI8+qmGcCowbcMeSjNW9qNnCUWlGKJ8hg yEf/hIfb+a4DsUksVTMzhf4P39IF72rnMVP7r+RMmC8i8QNnmBbwJxeg X-Gm-Gg: AfdE7ckJObzAO33YAsnwvjbrh2T62Bukk7Zs2ltGds+FvDZ4/w5e+3t9dvnJQzmVrG+ KAp5f7TFYea4t+Oy/kHa47Gpb+TWa3wkd4jjbOvbxUFtJ7+w0g7LLOkHXpkG7N51rIS8OeJSjCu 8zTaKWBfeu7u0CovX56QCOUtDcEP8XfdfGjF668sEgLa74PiZ3LP/9vyZ7d6+/ZlP3yNoaExCSi xJnGPQfvK1OaTNnncNCeOeU94kSE4n7fX2XH0mFkHJ7AWl/c8paKtp/uY3QDlajFaZIM42sQaRI Z7MieF1XAGD8q2XMQm2LVpM73u5GymbEDEnTYQbAGSy7Dv9kl/VrWDFt+DHHa3DTS1Tyhi+Z1hB n21FqoZVba/fLSqIaLAzlICFd/67Xm6aNF1N1gLg6DVWJ5/b3nEievQVskyl9YijQseA2Kvj5ir hj42qC6PJTaqs0nWeI84sFjLo8Q6hjoW7q9x4BgjCcYvcnUIqx4dUXqZoskoi9eI+Tqf3JaeAKM BnVTSY5iww= X-Received: by 2002:a05:6a00:a14:b0:841:58b0:82bb with SMTP id d2e1a72fcca58-845b3998244mr8220663b3a.9.1782485151758; Fri, 26 Jun 2026 07:45:51 -0700 (PDT) Received: from localhost.localdomain (211-20-143-81.hinet-ip.hinet.net. [211.20.143.81]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-845a413c39fsm7608673b3a.55.2026.06.26.07.45.50 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 26 Jun 2026 07:45:51 -0700 (PDT) From: =?UTF-8?q?HE=20WEI=20=28=E3=82=AE=E3=82=AB=E3=82=AF=29?= To: Johannes Berg Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, =?UTF-8?q?HE=20WEI=20=28=E3=82=AE=E3=82=AB=E3=82=AF=29?= Subject: [PATCH] wifi: cfg80211: bound element ID read when checking non-inheritance Date: Fri, 26 Jun 2026 23:45:43 +0900 Message-ID: <20260626144543.5034-1-skyexpoc@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element. _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN. Fixes: dfd9aa3e7a45 ("wifi: cfg80211: rewrite merging of inherited elements") Signed-off-by: HE WEI (ギカク) --- net/wireless/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 05b7dc6b7..0a44856b1 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -205,7 +205,7 @@ bool cfg80211_is_element_inherited(const struct element *elem, return true; if (elem->id == WLAN_EID_EXTENSION) { - if (!ext_id_len) + if (!ext_id_len || !elem->datalen) return true; loop_len = ext_id_len; list = &non_inherit_elem->data[3 + id_len]; -- 2.43.0