Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 2 Dec 2022 18:44:39 +0200
From:   Jouni Malinen <j@w1.fi>
To:     Aloka Dixit <quic_alokad@quicinc.com>
Cc:     johannes@sipsolutions.net, linux-wireless@vger.kernel.org
Subject: Re: [PATCH v2 01/10] mac80211: generate EMA beacons in AP mode
Message-ID: <20221202164439.GA700414@w1.fi>
References: <20221114201912.22893-1-quic_alokad@quicinc.com>
 <20221114201912.22893-2-quic_alokad@quicinc.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20221114201912.22893-2-quic_alokad@quicinc.com>
Precedence: bulk

On Mon, Nov 14, 2022 at 12:19:03PM -0800, Aloka Dixit wrote:
> diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
> @@ -3338,7 +3338,8 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
>  	len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
>  	      beacon->proberesp_ies_len + beacon->assocresp_ies_len +
>  	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len +
> -	      ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
> +	      ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies,
> +					      beacon->mbssid_ies->cnt);

beacon->mbssid_ies can be NULL here and that is going to result in a
kernel panic. For example, check with hostap.git test case
ap_ht_20_to_40_csa.

-- 
Jouni Malinen                                            PGP id EFC895FA