[PATCH] wifi: cfg80211: bound element ID read when checking non-inheritance

[PATCH] wifi: cfg80211: bound element ID read when checking non-inheritance

[HE WEI (ギカク)]

cfg80211_is_element_inherited() reads the first data octet of the
candidate element (id = elem->data[0]) to look it up in an extension
non-inheritance list. It does so after testing elem->id, but without
verifying that the element actually has a data octet. A zero-length
extension element (WLAN_EID_EXTENSION with length 0) therefore makes it
read one octet past the end of the element.

_ieee802_11_parse_elems_full() runs this check for every element of a
frame once a non-inheritance context exists -- e.g. while parsing a
per-STA profile of a Multi-Link element in a (re)association response,
or a non-transmitted BSS profile -- so a crafted frame from an AP can
trigger a one-octet slab-out-of-bounds read during element parsing:

  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited
  Read of size 1 ... in net/wireless/scan.c

Return early (treat the element as inherited) when an extension element
carries no data, mirroring the existing handling of empty ID lists.

The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

Fixes: dfd9aa3e7a45 ("wifi: cfg80211: rewrite merging of inherited elements")
Signed-off-by: HE WEI (ギカク) <skyexpoc@gmail.com>
---
 net/wireless/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 05b7dc6b7..0a44856b1 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -205,7 +205,7 @@ bool cfg80211_is_element_inherited(const struct element *elem,
 		return true;
 
 	if (elem->id == WLAN_EID_EXTENSION) {
-		if (!ext_id_len)
+		if (!ext_id_len || !elem->datalen)
 			return true;
 		loop_len = ext_id_len;
 		list = &non_inherit_elem->data[3 + id_len];
-- 
2.43.0

Re: [PATCH] wifi: cfg80211: bound element ID read when checking non-inheritance

[Johannes Berg]

On Fri, 2026-06-26 at 23:45 +0900, HE WEI (ギカク) wrote:

> 
> Fixes: dfd9aa3e7a45 ("wifi: cfg80211: rewrite merging of inherited elements")

This doesn't seem right at all?

johannes

Re: [PATCH] wifi: cfg80211: bound element ID read when checking non-inheritance

[HE WEI（ギカク）]

Hi Johannes,

I'm sorry, that was my oversight. After reconfirmation, I found that
cfg80211_is_element_inherited() was introduced in commit f7dacfb11475b
("cfg80211: support non-inheritance element"), not dfd9aa3e7a45.

The bug existed from the initial implementation of this function in 2019.
I will send v2 with the correct Fixes tag.

Thank you for catching this!

Best regards,
HE WEI（ギカク）

Johannes Berg <johannes@sipsolutions.net> 于2026年7月6日周一 20:44写道：
>
> On Fri, 2026-06-26 at 23:45 +0900, HE WEI (ギカク) wrote:
>
> >
> > Fixes: dfd9aa3e7a45 ("wifi: cfg80211: rewrite merging of inherited elements")
>
> This doesn't seem right at all?
>
> johannes

[PATCH v2] wifi: cfg80211: bound element ID read when checking non-inheritance

[HE WEI (ギカク)]

cfg80211_is_element_inherited() reads the first data octet of the
candidate element (id = elem->data[0]) to look it up in an extension
non-inheritance list. It does so after testing elem->id, but without
verifying that the element actually has a data octet. A zero-length
extension element (WLAN_EID_EXTENSION with length 0) therefore makes it
read one octet past the end of the element.

_ieee802_11_parse_elems_full() runs this check for every element of a
frame once a non-inheritance context exists -- e.g. while parsing a
per-STA profile of a Multi-Link element in a (re)association response,
or a non-transmitted BSS profile -- so a crafted frame from an AP can
trigger a one-octet slab-out-of-bounds read during element parsing:

  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited
  Read of size 1 ... in net/wireless/scan.c

Return early (treat the element as inherited) when an extension element
carries no data, mirroring the existing handling of empty ID lists.

The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

Changes in v2:
- Fixed the Fixes tag to point to the correct commit f7dacfb11475b
  ("cfg80211: support non-inheritance element")
- The bug was introduced in the original implementation in 2019, not in
  commit dfd9aa3e7a45

Fixes: f7dacfb11475b ("cfg80211: support non-inheritance element")
Signed-off-by: HE WEI (ギカク) <skyexpoc@gmail.com>
---
 net/wireless/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 05b7dc6b7..0a44856b1 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -205,7 +205,7 @@ bool cfg80211_is_element_inherited(const struct element *elem,
 		return true;
 
 	if (elem->id == WLAN_EID_EXTENSION) {
-		if (!ext_id_len)
+		if (!ext_id_len || !elem->datalen)
 			return true;
 		loop_len = ext_id_len;
 		list = &non_inherit_elem->data[3 + id_len];
-- 
2.43.0

[PATCH v3] wifi: cfg80211: bound element ID read when checking non-inheritance

[HE WEI (ギカク)]

cfg80211_is_element_inherited() reads the first data octet of the
candidate element (id = elem->data[0]) to look it up in an extension
non-inheritance list. It does so after testing elem->id, but without
verifying that the element actually has a data octet. A zero-length
extension element (WLAN_EID_EXTENSION with length 0) therefore makes it
read one octet past the end of the element.

_ieee802_11_parse_elems_full() runs this check for every element of a
frame once a non-inheritance context exists -- e.g. while parsing a
per-STA profile of a Multi-Link element in a (re)association response,
or a non-transmitted BSS profile -- so a crafted frame from an AP can
trigger a one-octet slab-out-of-bounds read during element parsing:

  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited
  Read of size 1 ... in net/wireless/scan.c

Return early (treat the element as inherited) when an extension element
carries no data, mirroring the existing handling of empty ID lists.

The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

Fixes: f7dacfb11475 ("cfg80211: support non-inheritance element")
Signed-off-by: HE WEI (ギカク) <skyexpoc@gmail.com>
---
Changes in v3:
- Move the version changelog below the --- line and trim the Fixes
  commit id to 12 characters (checkpatch).

Changes in v2:
- Correct the Fixes tag. The unchecked elem->data[0] read was
  introduced in 2019 by f7dacfb11475 ("cfg80211: support
  non-inheritance element") -- the commit that added
  cfg80211_is_element_inherited() -- not by dfd9aa3e7a45, which only
  rewrote the sibling cfg80211_gen_new_ie() and never touched this
  function.

 net/wireless/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 05b7dc6b7..0a44856b1 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -205,7 +205,7 @@ bool cfg80211_is_element_inherited(const struct element *elem,
 		return true;

 	if (elem->id == WLAN_EID_EXTENSION) {
-		if (!ext_id_len)
+		if (!ext_id_len || !elem->datalen)
 			return true;
 		loop_len = ext_id_len;
 		list = &non_inherit_elem->data[3 + id_len];
--
2.43.0