diff options
| author | Ariel Silver <arielsilver77@gmail.com> | 2026-02-20 10:11:29 +0000 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-02-23 12:35:34 +0100 |
| commit | 162d331d833dc73a3e905a24c44dd33732af1fc5 (patch) | |
| tree | 68d595720e0a8b6daad821826463fa398d40567d /tools/perf/lib/Documentation/tutorial/git@git.tavy.me:linux.git | |
| parent | 2259d14499d16b115ef8d5d2ddc867e2be7cb5b5 (diff) | |
wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
link_id is taken from the ML Reconfiguration element (control & 0x000f),
so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS
(15) elements, so index 15 is out-of-bounds. Skip subelements with
link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds
write.
Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element")
Reported-by: Ariel Silver <arielsilver77@gmail.com>
Signed-off-by: Ariel Silver <arielsilver77@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260220101129.1202657-1-Ariel.Silver@cybereason.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'tools/perf/lib/Documentation/tutorial/git@git.tavy.me:linux.git')
0 files changed, 0 insertions, 0 deletions