cfg80211: check S1G beacon compat element length
authorJohannes Berg <johannes.berg@intel.com>
Thu, 8 Apr 2021 12:28:27 +0000 (14:28 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 14 Apr 2021 06:42:02 +0000 (08:42 +0200)
commitcc1a702e6ec03b4f950fe6b62fd3dd2ef0fad749
tree66ee9642cd99e5fee62849b9eb0b4ebfcf3ae07f
parentfea52345f422517baadc49425bf8c944b4c425c0
cfg80211: check S1G beacon compat element length

commit b5ac0146492fc5c199de767e492be8a66471011a upstream.

We need to check the length of this element so that we don't
access data beyond its end. Fix that.

Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results")
Link: https://lore.kernel.org/r/20210408142826.f6f4525012de.I9fdeff0afdc683a6024e5ea49d2daa3cd2459d11@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/scan.c