cfg80211_parse_mbssid_data() keeps the length of a non-transmitted BSSID profile in a u8. cfg80211_merge_profile() returns a size_t, and it concatenates a profile that is split over several Multiple BSSID elements, so the merged length can be well above 255 even though every single sub-element is at most 255 bytes long. The value is then cut to its low 8 bits. A 300 byte profile is handled as a 44 byte one: the elements after the cut are lost from the generated non-transmitted BSS, and if the Multiple BSSID-Index element lies past the cut the BSS is dropped altogether. Any AP in range can send such a profile. The multi-link code further down in the same file already uses a signed size type for the profile length. Do the same here, cfg80211_find_ie() and cfg80211_gen_new_ie() take a size_t anyway. Fixes: fe806e4992c9 ("cfg80211: support profile split between elements") Cc: stable@vger.kernel.org Signed-off-by: Wahid Khan --- net/wireless/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index ac56338f0f43..8e9ce8336876 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2592,7 +2592,7 @@ cfg80211_parse_mbssid_data(struct wiphy *wiphy, if (elem->data[0] < 1 || (int)elem->data[0] > 8) continue; for_each_element(sub, elem->data + 1, elem->datalen - 1) { - u8 profile_len; + size_t profile_len; if (sub->id != 0 || sub->datalen < 4) { /* not a valid BSS profile */ -- 2.56.0