[PATCH] wifi: mwifiex: validate HT/VHT element length before storing beacon IE pointers

[PATCH] wifi: mwifiex: validate HT/VHT element length before storing beacon IE pointers

[Christopher Kleiner]

mwifiex_update_bss_desc_with_ie() stores raw pointers into the beacon
buffer for the HT Capability, HT Operation, VHT Capability and VHT
Operation elements without checking that the element is long enough to
hold the corresponding fixed-size structure. The generic IE loop only
guarantees that the declared element length fits inside the beacon
buffer (bytes_left >= total_ie_len); it does not guarantee that
element_len is large enough for the struct that later consumers copy.

beacon_buf is a tight kmemdup() of the over-the-air IEs. When the
association command is built, mwifiex_cmd_append_11n_tlv() /
mwifiex_cmd_append_11ac_tlv() copy a fixed number of bytes from the
stored pointers (sizeof(struct ieee80211_ht_cap) and friends). A
malicious AP that emits a beacon or probe response ending in a
truncated (e.g. zero-length) HT Capability element leaves bcn_ht_cap
pointing near the end of the slab, and the subsequent copy reads out of
bounds. The leaked bytes are placed into the association request
transmitted back to the AP, disclosing adjacent slab memory; on
CONFIG_KASAN / panic_on_oops kernels it is an out-of-bounds oops.

Commit 685c9b7750bf ("mwifiex: Abort at too short BSS descriptor
element") added such length checks for the FH/DS/CF/IBSS parameter sets
and a few other elements, but did not cover the HT/VHT capability and
operation elements. Validate element_len against the size of the
structure that will be consumed, mirroring those existing checks.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Cc: stable@vger.kernel.org
Signed-off-by: Christopher Kleiner <chris@kleiner.pro>
---
 drivers/net/wireless/marvell/mwifiex/scan.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 97c0ec3b822e..0196c2adfeed 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -1384,6 +1384,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
 							bss_entry->beacon_buf);
 			break;
 		case WLAN_EID_HT_CAPABILITY:
+			if (element_len < sizeof(struct ieee80211_ht_cap))
+				return -EINVAL;
 			bss_entry->bcn_ht_cap = (struct ieee80211_ht_cap *)
 					(current_ptr +
 					sizeof(struct ieee_types_header));
@@ -1392,6 +1394,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
 					bss_entry->beacon_buf);
 			break;
 		case WLAN_EID_HT_OPERATION:
+			if (element_len < sizeof(struct ieee80211_ht_operation))
+				return -EINVAL;
 			bss_entry->bcn_ht_oper =
 				(struct ieee80211_ht_operation *)(current_ptr +
 					sizeof(struct ieee_types_header));
@@ -1400,6 +1404,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
 					bss_entry->beacon_buf);
 			break;
 		case WLAN_EID_VHT_CAPABILITY:
+			if (element_len < sizeof(struct ieee80211_vht_cap))
+				return -EINVAL;
 			bss_entry->disable_11ac = false;
 			bss_entry->bcn_vht_cap =
 				(void *)(current_ptr +
@@ -1409,6 +1415,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
 					      bss_entry->beacon_buf);
 			break;
 		case WLAN_EID_VHT_OPERATION:
+			if (element_len < sizeof(struct ieee80211_vht_operation))
+				return -EINVAL;
 			bss_entry->bcn_vht_oper =
 				(void *)(current_ptr +
 					 sizeof(struct ieee_types_header));
-- 
2.43.0

Re: [PATCH] wifi: mwifiex: validate HT/VHT element length before storing beacon IE pointers

[Francesco Dolcini]

On Thu, Jul 16, 2026 at 08:00:17PM -0400, Christopher Kleiner wrote:
> mwifiex_update_bss_desc_with_ie() stores raw pointers into the beacon
> buffer for the HT Capability, HT Operation, VHT Capability and VHT
> Operation elements without checking that the element is long enough to
> hold the corresponding fixed-size structure. The generic IE loop only
> guarantees that the declared element length fits inside the beacon
> buffer (bytes_left >= total_ie_len); it does not guarantee that
> element_len is large enough for the struct that later consumers copy.
> 
> beacon_buf is a tight kmemdup() of the over-the-air IEs. When the
> association command is built, mwifiex_cmd_append_11n_tlv() /
> mwifiex_cmd_append_11ac_tlv() copy a fixed number of bytes from the
> stored pointers (sizeof(struct ieee80211_ht_cap) and friends). A
> malicious AP that emits a beacon or probe response ending in a
> truncated (e.g. zero-length) HT Capability element leaves bcn_ht_cap
> pointing near the end of the slab, and the subsequent copy reads out of
> bounds. The leaked bytes are placed into the association request
> transmitted back to the AP, disclosing adjacent slab memory; on
> CONFIG_KASAN / panic_on_oops kernels it is an out-of-bounds oops.
> 
> Commit 685c9b7750bf ("mwifiex: Abort at too short BSS descriptor
> element") added such length checks for the FH/DS/CF/IBSS parameter sets
> and a few other elements, but did not cover the HT/VHT capability and
> operation elements. Validate element_len against the size of the
> structure that will be consumed, mirroring those existing checks.
> 
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christopher Kleiner <chris@kleiner.pro>

Duplicate? We already have this in review https://lore.kernel.org/all/20260709100800.7026-1-doruk@0sec.ai/