Bryam Vargas
b224d18b1e
wifi: mac80211: bound S1G TIM PVB walk to the TIM element
...
ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a
received TIM element. The TIM is handed in as the element payload:
ieee802_11_parse_elems_full() stores elems->tim = elem->data and
elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes
are [tim, tim + tim_len).
When walking the encoded blocks the function passes the walker an end
sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of
the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end)
and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read
*ptr), so it can read up to two bytes beyond the TIM element -- an
out-of-bounds read of adjacent skb/heap data when the TIM is the last
element in the frame. The +2 appears to account for the element id/len
header, but tim already points past that header at the element payload, so
the addend is wrong.
Pass the correct element end, (const u8 *)tim + tim_len.
Fixes: e0c47c6229 ("wifi: mac80211: support parsing S1G TIM PVB")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me >
Link: https://patch.msgid.link/20260606074341.49135-1-hexlabsecurity@proton.me
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
2026-06-08 08:59:03 +02:00
..
2026-04-13 19:03:11 -07:00
2026-05-21 13:04:42 +02:00
2026-04-16 20:34:34 -07:00
2026-05-21 13:04:42 +02:00
2026-04-13 20:10:58 -07:00
2026-05-11 14:56:03 +02:00
2026-04-18 00:10:48 -07:00
2026-04-20 11:31:01 -07:00
2026-05-25 13:48:51 -07:00
2026-04-15 14:15:25 -07:00
2026-04-27 15:08:04 +02:00
2026-05-02 19:12:36 -07:00
2026-05-28 14:02:21 -07:00
2026-05-08 01:30:16 +02:00
2026-05-08 01:30:16 +02:00
2026-05-08 01:30:16 +02:00
2026-05-06 19:18:45 -07:00
2026-05-13 15:00:40 -07:00
2026-05-19 19:05:20 -07:00
2026-04-22 15:10:22 +01:00
2026-04-24 14:20:03 -07:00
2026-04-19 08:47:40 -07:00
2026-04-15 16:52:20 +02:00
2026-04-18 00:10:50 -07:00
2026-05-06 17:08:39 +01:00
2026-04-13 14:56:54 -07:00
2026-05-13 13:55:06 -06:00
2026-04-13 15:51:31 -07:00
2026-05-17 11:15:05 -07:00
2026-05-11 08:27:02 -07:00
2026-04-27 15:52:51 -06:00
2026-05-04 08:52:26 -10:00
2026-05-22 16:28:47 -07:00
2026-04-16 10:12:43 -07:00
2026-04-14 10:53:44 -07:00
2026-05-28 06:51:30 -07:00
2026-05-28 09:07:12 +02:00
2026-05-28 06:51:30 -07:00
2026-05-28 06:51:30 -07:00
2026-04-15 08:37:45 -07:00
2026-05-28 17:45:46 -07:00
2026-04-18 00:10:51 -07:00
2026-04-21 14:12:01 -07:00
2026-04-21 07:30:44 -07:00
2026-04-19 12:58:08 -07:00
2026-04-27 10:26:49 +02:00
2026-05-28 14:02:21 -07:00
2026-05-19 17:26:07 +02:00
2026-04-16 22:19:29 +02:00
2026-04-24 00:36:50 +02:00
2026-05-11 08:27:02 -07:00
2026-05-11 19:04:46 +09:00
2026-04-19 08:01:17 -07:00
2026-04-16 13:31:04 +02:00
2026-05-22 12:24:08 +02:00
2026-05-13 17:40:02 -07:00
2026-05-12 18:03:37 +02:00
2026-05-21 16:14:33 +02:00
2026-05-13 17:40:02 -07:00
2026-05-21 19:06:11 -07:00
2026-05-21 19:06:11 -07:00
2026-04-22 09:50:46 -07:00
2026-06-03 14:11:58 +02:00
2026-06-03 14:07:07 +02:00
2026-06-08 08:59:03 +02:00
2026-06-03 14:11:58 +02:00
2026-06-03 14:11:56 +02:00
2026-05-14 12:42:11 +02:00
2026-05-13 17:52:55 -07:00
2026-04-23 12:13:57 +02:00
2026-05-04 19:09:41 -07:00
2026-05-07 16:06:28 +03:00
2026-04-13 16:22:30 -07:00
2026-04-15 12:59:16 -07:00
2026-05-08 17:00:44 +02:00
2026-04-18 00:10:48 -07:00
2026-04-21 16:41:54 +01:00
2026-05-18 12:26:51 +02:00
2026-05-12 14:42:29 +02:00
2026-04-18 00:10:50 -07:00
2026-05-26 17:26:57 -07:00
2026-04-13 15:42:19 -07:00
2026-04-18 13:07:36 -05:00
2026-04-27 05:54:25 -07:00
2026-04-18 11:29:14 -07:00
2026-04-18 00:10:48 -07:00
2026-04-18 00:10:47 -07:00
2026-05-21 19:06:13 -07:00
2026-04-15 12:59:16 -07:00
2026-04-19 08:01:17 -07:00
2026-04-27 18:46:17 -07:00
2026-04-13 14:56:28 -07:00
2026-05-28 14:47:44 -07:00
2026-05-12 14:42:32 +02:00
2026-05-13 18:09:13 -07:00
2026-04-22 08:53:23 -04:00
2026-04-13 11:46:08 -07:00
2026-04-24 00:34:59 +02:00
2026-04-27 15:47:21 -06:00
2026-04-17 14:09:02 -07:00
2026-05-21 19:06:13 -07:00
2026-04-15 14:41:21 -07:00
2026-04-18 00:10:50 -07:00
2026-04-20 11:35:17 -07:00
2026-04-20 15:42:18 -07:00
2026-05-13 17:52:55 -07:00
2026-04-21 12:48:44 +02:00
2026-04-20 20:10:50 -10:00
2026-04-20 20:10:50 -10:00
2026-05-08 17:00:44 +02:00
2026-05-06 17:40:15 +02:00
2026-05-05 16:02:57 +02:00
2026-05-14 08:32:11 -07:00
2026-04-13 15:42:19 -07:00
2026-04-19 08:44:41 -07:00
2026-04-19 08:01:17 -07:00
2026-05-28 14:02:21 -07:00
2026-05-05 16:12:07 +08:00
2026-05-01 16:24:25 -05:00
2026-05-14 18:00:40 -07:00
2026-04-18 00:10:47 -07:00
2026-05-28 06:51:30 -07:00
2026-04-13 19:03:11 -07:00
2026-04-17 14:23:26 -06:00
2026-05-01 17:22:45 -07:00
2026-04-21 18:54:28 +03:00
2026-04-28 14:28:29 -04:00
2026-04-18 00:10:54 -07:00
2026-05-13 14:49:06 -06:00
2026-04-20 12:02:24 -07:00
2026-04-28 06:13:40 -10:00