1:  4c458b4bd320 ! 1:  17222e352fb3 wifi: nxpwifi: validate variable IE lengths in beacon parser
    @@ Commit message
         capability and operation elements, to the operating mode notification
         and to the 20/40 BSS coexistence element, taken from a beacon or probe
         response, without checking that each element is long enough for the
    -    fixed size structure or field the driver later dereferences it as.
    +    structure the driver later dereferences it as.
     
    -    bss_desc->beacon_buf is a tight kmemdup() of the on-air elements in
    -    nxpwifi_fill_new_bss_desc(), so a truncated element leaves the stored
    -    pointer short of the structure and the consumers read past the end of
    -    that allocation when the descriptor is used at association time:
    -
    -      nxpwifi_cmd_append_11n_tlv() memcpy()s sizeof(struct ieee80211_ht_cap)
    -      from bcn_ht_cap, reads bcn_ht_oper->ht_param and ->primary_chan, and
    -      memcpy()s one byte from bcn_bss_co_2040 + sizeof(struct element);
    -      nxpwifi_cmd_append_11ac_tlv() memcpy()s from bcn_vht_cap and
    -      bcn_vht_oper and reads oper_mode->oper_mode;
    -      nxpwifi_is_ap_11ax_twt_supported() reads bcn_he_cap->mac_cap_info[0]
    -      and bcn_ext_cap->data[9].
    -
    -    An element carrying a zero length placed last in the frame leaves the
    -    stored pointer at the end of the allocation, so the read is entirely out
    -    of bounds. The bytes read for the HT and VHT capabilities and for the
    -    20/40 coexistence element are also copied into the association request,
    -    so they are disclosed to the AP that supplied the frame. A rogue access
    -    point in radio range can trigger this when the victim associates.
    +    bss_desc->beacon_buf is a tight kmemdup() of the on-air elements, so a
    +    truncated element leaves the stored pointer short of the structure and
    +    the consumers read past the end of that allocation at association time.
    +    Some of those bytes are copied into the association request, so a rogue
    +    access point in range can both trigger the read and receive the result.
     
         Reject the frame with -EINVAL when any of these elements is shorter than
    -    the structure the driver reads, matching the length validation the FH,
    -    DS and CF parameter set cases in the same parser already perform. The
    -    operating mode notification pointer includes the element header, so it
    -    is checked against total_ie_len. The HT and VHT pointers skip the header
    -    and the HE pointers additionally skip the extension ID, so those are
    -    checked against element_len.
    -
    -    Commit 8e4f5ca8bf67 ("wifi: nxpwifi: reject zero-length extension
    -    elements in beacon IEs") made the extension ID itself safe to read, but
    -    the fixed size structures behind these pointers are still unchecked.
    -
    -    Feeding an eight byte element stream ending in a zero length HT
    -    capability element to nxpwifi_update_bss_desc_with_ie() and then copying
    -    from bcn_ht_cap as the association path does gives, on a KASAN kernel:
    -
    -      BUG: KASAN: slab-out-of-bounds in nxpwifi_oob_repro+0x133/0x180
    -      Read of size 1 at addr ffff88800716c308 by task swapper/0/1
    -      CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.3.0-rc1 #1
    -      Call Trace:
    -       dump_stack_lvl+0x53/0x70
    -       print_report+0xd0/0x630
    -       kasan_report+0xce/0x100
    -       nxpwifi_oob_repro+0x133/0x180
    -       do_one_initcall+0x9a/0x2e0
    -       kernel_init_freeable+0x294/0x460
    +    the structure read from it, as the FH, DS and CF parameter set cases in
    +    the same parser already do.
     
    -    With this patch the parser rejects the frame with -EINVAL, bcn_ht_cap
    -    stays NULL, and KASAN is silent.
    +    The extended capabilities element has no structure size to check
    +    against, so nxpwifi_is_ap_11ax_twt_supported()'s read of
    +    bcn_ext_cap->data[9] is bounded at that consumer instead.
     
         Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
    -    Cc: stable@vger.kernel.org
    -    Assisted-by: LLM (Claude Code)
    +    Assisted-by: LLM
         Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
     
      ## drivers/net/wireless/nxp/nxpwifi/11ax.c ##