mac80211: fix skb length check in ieee80211_scan_rx()
authorDu Cheng <ducheng2@gmail.com>
Mon, 10 May 2021 04:16:49 +0000 (12:16 +0800)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 31 May 2021 19:39:10 +0000 (21:39 +0200)
commite298aa358f0ca658406d524b6639fe389cb6e11e
treeb2e85597f417c85427254241077919472b53bf17
parentb90f51e8e1f5014c01c82a7bf4c611643d0a8bcb
mac80211: fix skb length check in ieee80211_scan_rx()

Replace hard-coded compile-time constants for header length check
with dynamic determination based on the frame type. Otherwise, we
hit a validation WARN_ON in cfg80211 later.

Fixes: cd418ba63f0c ("mac80211: convert S1G beacon to scan results")
Reported-by: syzbot+405843667e93b9790fc1@syzkaller.appspotmail.com
Signed-off-by: Du Cheng <ducheng2@gmail.com>
Link: https://lore.kernel.org/r/20210510041649.589754-1-ducheng2@gmail.com
[style fixes, reword commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/scan.c