[PATCH 5/8] wifi: mac80211: validate probe response countdown offsets

[Zhao Li <enderaoelyther@gmail.com>]

ieee80211_set_beacon_cntdwn() writes the current countdown value into
each configured counter offset. For the beacon it skips offset 0 as an
unused entry and bounds each non-zero offset against the template length
before writing. The AP probe-response branch reuses the same
counter-offset array but indexes resp->data[] with neither the
zero-sentinel skip nor the length check.

A probe-response template whose countdown offset is 0 or points past
resp->len therefore takes a stray or out-of-bounds write. Apply the same
zero-sentinel and length checks the beacon path uses before writing the
probe-response countdown byte.

Fixes: 5f9404abdf2a ("mac80211: add support for BSS color change")
Assisted-by: Codex:gpt-5
Assisted-by: Claude:opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
 net/mac80211/tx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 91b14112e24f0..84b6eda46a8f0 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -5249,6 +5249,10 @@ static void ieee80211_set_beacon_cntdwn(struct ieee80211_sub_if_data *sdata,
 		if (sdata->vif.type == NL80211_IFTYPE_AP && resp) {
 			u16 *resp_offsets = resp->cntdwn_counter_offsets;
 
+			if (!resp_offsets[i])
+				continue;
+			if (WARN_ON_ONCE(resp_offsets[i] >= resp->len))
+				return;
 			resp->data[resp_offsets[i]] = count;
 		}
 	}
-- 
2.50.1 (Apple Git-155)