[PATCH v2] wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

[PATCH v2] wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

[cr-ArielSilver]

From: Ariel Silver <arielsilver77@gmail.com>

link_id is taken from the ML Reconfiguration element (control & 0x000f),
so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS
(15) elements, so index 15 is out-of-bounds. Skip subelements with
link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds
write.

Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element")
Reported-by: Ariel Silver <arielsilver77@gmail.com>
Signed-off-by: Ariel Silver <arielsilver77@gmail.com>
Cc: stable@vger.kernel.org
---
 net/mac80211/mlme.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -7073,6 +7073,10 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
 		control = le16_to_cpu(prof->control);
 		link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID;
 
+		if (link_id >= IEEE80211_MLD_MAX_NUM_LINKS)
+			continue;
+
 		removed_links |= BIT(link_id);
 
 		/* the MAC address should not be included, but handle it */

Re: [PATCH v2] wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

[Johannes Berg]

On Fri, 2026-02-20 at 10:11 +0000, cr-ArielSilver wrote:
> From: Ariel Silver <arielsilver77@gmail.com>
> 
> link_id is taken from the ML Reconfiguration element (control & 0x000f),
> so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS
> (15) elements, so index 15 is out-of-bounds. Skip subelements with
> link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds
> write.
> 
> Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element")
> Reported-by: Ariel Silver <arielsilver77@gmail.com>
> Signed-off-by: Ariel Silver <arielsilver77@gmail.com>

I'll apply this anyway, but ...

> --- a/net/mac80211/mlme.c
> +++ b/net/mac80211/mlme.c
> @@ -7073,6 +7073,10 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,

How did this line happen? You're only adding 3 new lines. How is it even
_possible_ to get this wrong?!

johannes