From: Zhao Li Commit d160663ca2fa ("wifi: mac80211: fix TPE in channel switch wrapper parsing") replaced cfg80211_find_ext_elem() with for_each_element_id() for Transmit Power Envelope elements inside a Channel Switch Wrapper, but kept the offset that skipped the Extension ID. The parser now drops the first byte of each element and misreads the rest. ieee80211_parse_tpe() takes a u8 length, so for a zero-length element 0 - 1 wraps around to 255 and the parser reads past the element. Received beacons are parsed this way when the BSS table is updated, with or without a connection, so a frame sent over the air can trigger it. Pass the element body and length unchanged, as for a top-level Transmit Power Envelope element. AI assistance was used. Fixes: d160663ca2fa ("wifi: mac80211: fix TPE in channel switch wrapper parsing") Cc: stable@vger.kernel.org Signed-off-by: Zhao Li --- Changes in v2: - Preserve the author name in the mail metadata; no code changes. Tested the in-tree parser with a ten-case KUnit extension under KASAN, applied identically to the base and fixed kernels. The base fails three decoding cases and reports a slab-out-of-bounds read for a zero-length nested TPE. All ten cases pass with the fix, without KASAN reports; the existing TPE suite also passes on both kernels. Compile-tested with no new W=1 GCC/Clang, sparse or smatch warnings. net/mac80211/parse.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c index f3c5a9f6ec7c..7564d655919f 100644 --- a/net/mac80211/parse.c +++ b/net/mac80211/parse.c @@ -698,8 +698,8 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params, for_each_element_id(subelem, WLAN_EID_TX_POWER_ENVELOPE, pos, elen) ieee80211_parse_tpe(&elems->csa_tpe, - subelem->data + 1, - subelem->datalen - 1); + subelem->data, + subelem->datalen); break; case WLAN_EID_COUNTRY: elems->country_elem = pos; base-commit: 6b4b543fa18757297ac756a6fe6e64f506b7844a -- 2.56.0