1 files changed, 35 insertions, 2 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d21b1581a665..7386421e2ad3 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -201,6 +201,38 @@ cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 }
 
+static int validate_beacon_head(const struct nlattr *attr,
+                                struct netlink_ext_ack *extack)
+{
+        const u8 *data = nla_data(attr);
+        unsigned int len = nla_len(attr);
+        const struct element *elem;
+        const struct ieee80211_mgmt *mgmt = (void *)data;
+        unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
+                                         u.beacon.variable);
+
+        if (len < fixedlen)
+                goto err;
+
+        if (ieee80211_hdrlen(mgmt->frame_control) !=
+            offsetof(struct ieee80211_mgmt, u.beacon))
+                goto err;
+
+        data += fixedlen;
+        len -= fixedlen;
+
+        for_each_element(elem, data, len) {
+                /* nothing */
+        }
+
+        if (for_each_element_completed(elem, data, len))
+                return 0;
+
+err:
+        NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
+        return -EINVAL;
+}
+
 static int validate_ie_attr(const struct nlattr *attr,
                             struct netlink_ext_ack *extack)
 {
@@ -338,8 +370,9 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 
         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
-        [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
-                                       .len = IEEE80211_MAX_DATA_LEN },
+        [NL80211_ATTR_BEACON_HEAD] =
+                NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
+                                       IEEE80211_MAX_DATA_LEN),
         [NL80211_ATTR_BEACON_TAIL] =
                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
                                        IEEE80211_MAX_DATA_LEN),