[PATCH AUTOSEL 6.18-5.10] wifi: iwlwifi: mvm: fix an off-by-1 boundary check

[Sasha Levin]

From: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx>

[ Upstream commit d77aff138c9ec6c8562f4c2c9f262d3d9c4b4cb8 ]

Before looking at the 11th byte, check the length is big enough.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx>
Reviewed-by: Ilan Peer <ilan.peer@xxxxxxxxx>
Link: https://patch.msgid.link/20260714141909.d22bf52a18d0.If0ef6612a67cca671428b06dbdeec68549e50ae6@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@xxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---

LLM Generated explanations, may be completely bogus:

**Verdict: YES** — backport to this tree (Linux 6.18.44).

This is a one-line fix in `iwl_mvm_check_he_obss_narrow_bw_ru_iter()`:
the check used `elem->datalen < 10` but then read `elem->data[10]`, so
an Extended Capabilities element with exactly 10 data bytes caused an
out-of-bounds read. The bug has been present since 2019 (`4f58121dc40a`)
and still exists in 6.18.44; fix `d77aff138c9ec` applies cleanly and is
only on mainline so far, not in this stable tree.

Worth noting: the same off-by-one exists in `iwl_mld/mac80211.c`, but
this commit only fixes the mvm path.

 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 2d2587c6e9757..92471bc7b505b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -3529,7 +3529,7 @@ static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 	elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies->data,
 				  ies->len);
 
-	if (!elem || elem->datalen < 10 ||
+	if (!elem || elem->datalen < 11 ||
 	    !(elem->data[10] &
 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
 		data->tolerated = false;
-- 
2.53.0