Patch "mac80211: Allow HE operation to be longer than expected." has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mac80211: Allow HE operation to be longer than expected.

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mac80211-allow-he-operation-to-be-longer-than-expect.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b9d3817cd669ee929fa670b9558786a0d773c69e
Author: Brian Norris <briannorris@xxxxxxxxxxxx>
Date:   Tue Feb 23 13:19:26 2021 +0800

    mac80211: Allow HE operation to be longer than expected.
    
    [ Upstream commit 0f7e90faddeef53a3568f449a0c3992d77510b66 ]
    
    We observed some Cisco APs sending the following HE Operation IE in
    associate response:
    
      ff 0a 24 f4 3f 00 01 fc ff 00 00 00
    
    Its HE operation parameter is 0x003ff4, so the expected total length is
    7 which does not match the actual length = 10. This causes association
    failing with "HE AP is missing HE Capability/operation."
    
    According to P802.11ax_D4 Table9-94, HE operation is extensible, and
    according to 802.11-2016 10.27.8, STA should discard the part beyond
    the maximum length and parse the truncated element.
    
    Allow HE operation element to be longer than expected to handle this
    case and future extensions.
    
    Fixes: e4d005b80dee ("mac80211: refactor extended element parsing")
    Signed-off-by: Brian Norris <briannorris@xxxxxxxxxxxx>
    Signed-off-by: Yen-lin Lai <yenlinlai@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20210223051926.2653301-1-yenlinlai@xxxxxxxxxxxx
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6adfcb9c06dc..3f483e84d5df 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -5023,7 +5023,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
 		he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
 						  ies->data, ies->len);
 		if (he_oper_ie &&
-		    he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
+		    he_oper_ie[1] >= ieee80211_he_oper_size(&he_oper_ie[3]))
 			he_oper = (void *)(he_oper_ie + 3);
 		else
 			he_oper = NULL;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 94e624e9439b..d8f9fb0646a4 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -967,7 +967,7 @@ static void ieee80211_parse_extension_element(u32 *crc,
 		break;
 	case WLAN_EID_EXT_HE_OPERATION:
 		if (len >= sizeof(*elems->he_operation) &&
-		    len == ieee80211_he_oper_size(data) - 1) {
+		    len >= ieee80211_he_oper_size(data) - 1) {
 			if (crc)
 				*crc = crc32_be(*crc, (void *)elem,
 						elem->datalen + 2);