Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-08 14:13:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

wifi: ieee80211: Support validating ML station profile length

Browse Source 
Add a function to validate EHT Multi-Link per station profile length.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Ilan Peer 2022-09-07 10:34:30 +03:00 committed by Johannes Berg
parent 53ad07e982
commit 7b6f08771b
1 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
include/linux/ieee80211.h
View File

@ -4685,6 +4685,46 @@ struct ieee80211_mle_per_sta_profile {
u8 variable[];
} __packed;
/**
* ieee80211_mle_sta_prof_size_ok - validate multi-link element sta profile size
* @data: pointer to the sub element data
* @len: length of the containing sub element
*/
static inline bool ieee80211_mle_sta_prof_size_ok(const u8 *data, size_t len)
{
const struct ieee80211_mle_per_sta_profile *prof = (const void *)data;
u16 control;
u8 fixed = sizeof(*prof);
u8 info_len = 1;
if (len < fixed)
return false;
control = le16_to_cpu(prof->control);
if (control & IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT)
info_len += 6;
if (control & IEEE80211_MLE_STA_CONTROL_BEACON_INT_PRESENT)
info_len += 2;
if (control & IEEE80211_MLE_STA_CONTROL_TSF_OFFS_PRESENT)
info_len += 8;
if (control & IEEE80211_MLE_STA_CONTROL_DTIM_INFO_PRESENT)
info_len += 2;
if (control & IEEE80211_MLE_STA_CONTROL_BSS_PARAM_CHANGE_CNT_PRESENT)
info_len += 1;
if (control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE &&
control & IEEE80211_MLE_STA_CONTROL_NSTR_BITMAP_SIZE) {
if (control & IEEE80211_MLE_STA_CONTROL_NSTR_BITMAP_SIZE)
info_len += 2;
else
info_len += 1;
}
return prof->sta_info_len >= info_len &&
fixed + prof->sta_info_len <= len;
}
#define for_each_mle_subelement(_elem, _data, _len) \
if (ieee80211_mle_size_ok(_data, _len)) \
for_each_element(_elem, \