Currently struct ieee80211_tim_ie defines: u8 virtual_map[1]; Per the guidance in [1] change this to be a flexible array. As a result of this change, adjust all related struct size tests to account for the fact that the sizeof(struct ieee80211_tim_ie) no accounts for the minimum size of the virtual_map. [1] https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays Signed-off-by: Jeff Johnson <quic_jjohnson@xxxxxxxxxxx> --- drivers/net/wireless/ath/ath9k/recv.c | 2 +- drivers/net/wireless/ath/carl9170/rx.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 2 +- drivers/net/wireless/realtek/rtlwifi/ps.c | 2 +- drivers/net/wireless/st/cw1200/txrx.c | 2 +- include/linux/ieee80211.h | 4 ++-- net/mac80211/util.c | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c index 0c0624a3b40d..2a263a1b7fbf 100644 --- a/drivers/net/wireless/ath/ath9k/recv.c +++ b/drivers/net/wireless/ath/ath9k/recv.c @@ -520,7 +520,7 @@ static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb) break; if (id == WLAN_EID_TIM) { - if (elen < sizeof(*tim)) + if (elen <= sizeof(*tim)) break; tim = (struct ieee80211_tim_ie *) pos; if (tim->dtim_count != 0) diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c index 908c4c8b7f82..5bdbde8c98a3 100644 --- a/drivers/net/wireless/ath/carl9170/rx.c +++ b/drivers/net/wireless/ath/carl9170/rx.c @@ -542,7 +542,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len) if (!tim) return; - if (tim[1] < sizeof(*tim_ie)) + if (tim[1] <= sizeof(*tim_ie)) return; tim_len = tim[1]; diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c index 9a9cfd0ce402..f594835da7ce 100644 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c @@ -669,7 +669,7 @@ static void rt2x00lib_rxdone_check_ps(struct rt2x00_dev *rt2x00dev, if (!tim) return; - if (tim[1] < sizeof(*tim_ie)) + if (tim[1] <= sizeof(*tim_ie)) return; tim_len = tim[1]; diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c index 629c03271bde..ea4b055bc6d8 100644 --- a/drivers/net/wireless/realtek/rtlwifi/ps.c +++ b/drivers/net/wireless/realtek/rtlwifi/ps.c @@ -506,7 +506,7 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len) if (!tim) return; - if (tim[1] < sizeof(*tim_ie)) + if (tim[1] <= sizeof(*tim_ie)) return; tim_len = tim[1]; diff --git a/drivers/net/wireless/st/cw1200/txrx.c b/drivers/net/wireless/st/cw1200/txrx.c index e16e9ae90d20..c2a51cd79ab8 100644 --- a/drivers/net/wireless/st/cw1200/txrx.c +++ b/drivers/net/wireless/st/cw1200/txrx.c @@ -1166,7 +1166,7 @@ void cw1200_rx_cb(struct cw1200_common *priv, size_t ies_len = skb->len - (ies - (u8 *)(skb->data)); tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies, ies_len); - if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) { + if (tim_ie && tim_ie[1] > sizeof(struct ieee80211_tim_ie)) { struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *)&tim_ie[2]; diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index bd2f6e19c357..4cdc2eb98f16 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -961,7 +961,7 @@ struct ieee80211_tim_ie { u8 dtim_period; u8 bitmap_ctrl; /* variable size: 1 - 251 bytes */ - u8 virtual_map[1]; + u8 virtual_map[]; } __packed; /** @@ -4405,7 +4405,7 @@ static inline bool ieee80211_check_tim(const struct ieee80211_tim_ie *tim, u8 mask; u8 index, indexn1, indexn2; - if (unlikely(!tim || tim_len < sizeof(*tim))) + if (unlikely(!tim || tim_len <= sizeof(*tim))) return false; aid &= 0x3fff; diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 8a6917cf63cf..0c23223bb030 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1123,7 +1123,7 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params, elem_parse_failed = true; break; case WLAN_EID_TIM: - if (elen >= sizeof(struct ieee80211_tim_ie)) { + if (elen > sizeof(struct ieee80211_tim_ie)) { elems->tim = (void *)pos; elems->tim_len = elen; } else -- 2.25.1
