Re: [PATCH 2/3] wifi: cfg80211: validate assoc response length before status and IE access

[Johannes Berg]

On Sat, 2026-06-13 at 02:50 +0800, Zhao Li wrote:
> cfg80211_rx_assoc_resp() initialises the status and response-IE fields
> of cfg80211_connect_resp_params from the management frame before
> proving that the frame is long enough for those offsets. S1G and
> regular association responses also have different IE offsets, but the
> S1G path only patched resp_ie after the unsafe initialiser had already
> run.

What makes you claim "unsafe"?

johannes