wifi: cfg80211: fix buffer overflow in elem comparison
authorJohannes Berg <johannes.berg@intel.com>
Fri, 25 Nov 2022 11:36:57 +0000 (12:36 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Dec 2022 10:28:40 +0000 (11:28 +0100)
commit88a6fe3707888bd1893e9741157a7035c4159ab6
treeea4e9057c9ff42ee09d187f8730dd386a99430c8
parent08fff7aaeb7e1408d363093280a5888e2f947b3e
wifi: cfg80211: fix buffer overflow in elem comparison

[ Upstream commit 9f16b5c82a025cd4c864737409234ddc44fb166a ]

For vendor elements, the code here assumes that 5 octets
are present without checking. Since the element itself is
already checked to fit, we only need to check the length.

Reported-and-tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/wireless/scan.c