Veerendranath Jakkam 023c1f2f06 wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation ... Currently during the multi-link element defragmentation process, the multi-link element length added to the total IEs length when calculating the length of remaining IEs after the multi-link element in cfg80211_defrag_mle(). This could lead to out-of-bounds access if the multi-link element or its corresponding fragment elements are the last elements in the IEs buffer. To address this issue, correctly calculate the remaining IEs length by deducting the multi-link element end offset from total IEs end offset. Cc: stable@vger.kernel.org Fixes: 2481b5da9c ("wifi: cfg80211: handle BSS data contained in ML probe responses") Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com> Link: https://patch.msgid.link/20250424-fix_mle_defragmentation_oob_access-v1-1-84412a1743fa@quicinc.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2025-05-06 21:04:40 +02:00
..
certs
tests
.gitignore
ap.c
chan.c	wifi: cfg80211: expose cfg80211_chandef_get_width()	2025-03-12 09:50:24 +01:00
core.c	treewide: Switch/rename to timer_delete[_sync]()	2025-04-05 10:30:12 +02:00
core.h	wifi: cfg80211: move link reconfig parameters into a struct	2025-03-11 10:51:58 +01:00
debugfs.c
debugfs.h
ethtool.c
ibss.c
Kconfig
Makefile
mesh.c
mlme.c	wifi: cfg80211: Update the link address when a link is added	2025-03-11 10:53:10 +01:00
nl80211.c	wifi: nl80211: re-enable multi-link reconfiguration	2025-03-18 14:52:11 +01:00
nl80211.h
ocb.c
of.c
pmsr.c
radiotap.c
rdev-ops.h	wifi: cfg80211: move link reconfig parameters into a struct	2025-03-11 10:51:58 +01:00
reg.c	Merge net-next/main to resolve conflicts	2025-03-18 09:46:36 +01:00
reg.h
scan.c	wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation	2025-05-06 21:04:40 +02:00
sme.c
sysfs.c
sysfs.h
trace.c
trace.h	wifi: cfg80211: allow setting extended MLD capa/ops	2025-03-11 10:51:59 +01:00
util.c	wifi: cfg80211: expose cfg80211_chandef_get_width()	2025-03-12 09:50:24 +01:00
wext-compat.c
wext-compat.h
wext-core.c
wext-priv.c
wext-proc.c
wext-sme.c