Re: [PATCH] wifi: p54: fix incorrect frame length check in p54_find_ie()

[Johannes Berg]

On Sun, 2026-09-06 at 13:06 +0200, Christian Lamparter wrote:
> 
> >        pos = (u8 *)mgmt->u.beacon.variable;
> >        end = skb->data + skb->len;
> >        while (pos < end) {
> >                if (pos + 2 + pos[1] > end)
> >                        return NULL;
> > 
> >                if (pos[0] == ie)
> >                        return pos;
> > 
> >                pos += 2 + pos[1];
> >        }
> >        return NULL;
> 
> The check in the while loop and the checks within the while loop make sure that
> no "pos" is returned unless the IE is still within skb->len.
> 
> But true, it should have been *mgmt and not mgmt.

FWIW, I dropped it because it really shouldn't have been there this way
since 'mgmt' can be far bigger than needed since it contains the union
for all kinds of action frames etc.

I'm not even sure it's needed regardless of the next check since the
beacon is built by mac80211.

Just blindly patching one mistake for another doesn't help anyone.

johannes