Files
linux/include/linux
Bryam Vargas b224d18b1e wifi: mac80211: bound S1G TIM PVB walk to the TIM element
ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a
received TIM element. The TIM is handed in as the element payload:
ieee802_11_parse_elems_full() stores elems->tim = elem->data and
elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes
are [tim, tim + tim_len).

When walking the encoded blocks the function passes the walker an end
sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of
the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end)
and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read
*ptr), so it can read up to two bytes beyond the TIM element -- an
out-of-bounds read of adjacent skb/heap data when the TIM is the last
element in the frame. The +2 appears to account for the element id/len
header, but tim already points past that header at the element payload, so
the addend is wrong.

Pass the correct element end, (const u8 *)tim + tim_len.

Fixes: e0c47c6229 ("wifi: mac80211: support parsing S1G TIM PVB")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260606074341.49135-1-hexlabsecurity@proton.me
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-08 08:59:03 +02:00
..
2026-02-11 13:44:47 +01:00
2026-04-02 15:52:49 +02:00
2026-03-18 15:11:40 +05:30
2026-05-21 13:04:42 +02:00
2026-03-19 23:55:27 +01:00
2026-05-06 19:18:45 -07:00
2026-01-20 19:44:19 -08:00
2026-04-03 16:53:50 -04:00
2025-11-21 11:21:31 +01:00
2026-04-04 08:10:37 -06:00
2026-03-16 13:16:49 +01:00
2026-03-02 17:08:05 -05:00
2026-05-28 17:45:46 -07:00
2026-03-31 19:15:21 +02:00
2026-05-19 17:26:07 +02:00
2025-12-13 20:04:32 +12:00
2026-03-23 13:33:51 -04:00
2026-04-07 17:38:07 +02:00
2026-02-19 09:12:05 +01:00
2025-12-23 11:23:10 -08:00
2026-02-27 16:40:16 +01:00
2026-01-12 16:52:09 +01:00
2026-02-23 13:43:16 -08:00
2026-02-06 07:29:14 -07:00
2026-04-05 13:53:28 -07:00
2026-01-05 16:43:31 +01:00
2026-01-11 06:09:11 -10:00
2026-04-01 10:19:41 +02:00
2026-04-03 16:53:50 -04:00
2026-04-03 16:53:50 -04:00
2026-03-18 09:59:57 +00:00
2026-04-06 11:39:54 +02:00
2026-04-05 13:53:00 -07:00
2025-11-23 12:30:40 +01:00
2026-03-17 15:34:47 +05:30
2025-12-29 11:53:38 +01:00
2026-01-26 20:02:27 -08:00
2026-03-08 11:06:53 +01:00
2026-03-27 07:35:05 -07:00
2026-01-30 11:34:34 +00:00
2026-04-05 13:53:10 -07:00
2026-02-10 11:39:31 +01:00
2026-02-10 11:39:30 +01:00
2026-01-11 06:09:11 -10:00
2026-04-20 11:35:17 -07:00
2026-02-27 16:40:16 +01:00
2026-01-11 06:09:11 -10:00
2026-03-08 11:06:53 +01:00
2025-11-28 09:21:18 -07:00
2026-03-31 07:04:00 -06:00
2026-05-05 16:12:07 +08:00
2026-03-25 20:11:29 +01:00
2026-03-13 08:22:54 +01:00
2026-03-12 15:05:34 +01:00
2026-04-13 08:39:51 -07:00
2026-04-06 09:06:39 +02:00
2026-03-30 16:43:24 -06:00
2026-01-30 18:26:59 -08:00