1 files changed, 35 insertions, 2 deletions

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 0a5ad95ac8b0..32f7a3b3d43c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -572,24 +572,40 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
         size_t left = len;
         u8 *pos = start;
         bool calc_crc = filter != 0;
+        DECLARE_BITMAP(seen_elems, 256);
 
+        bitmap_zero(seen_elems, 256);
         memset(elems, 0, sizeof(*elems));
         elems->ie_start = start;
         elems->total_len = len;
 
         while (left >= 2) {
                 u8 id, elen;
+                bool elem_parse_failed;
 
                 id = *pos++;
                 elen = *pos++;
                 left -= 2;
 
-                if (elen > left)
+                if (elen > left) {
+                        elems->parse_error = true;
                         break;
+                }
+
+                if (id != WLAN_EID_VENDOR_SPECIFIC &&
+                    id != WLAN_EID_QUIET &&
+                    test_bit(id, seen_elems)) {
+                        elems->parse_error = true;
+                        left -= elen;
+                        pos += elen;
+                        continue;
+                }
 
                 if (calc_crc && id < 64 && (filter & (1ULL << id)))
                         crc = crc32_be(crc, pos - 2, elen + 2);
 
+                elem_parse_failed = false;
+
                 switch (id) {
                 case WLAN_EID_SSID:
                         elems->ssid = pos;
@@ -615,7 +631,8 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         if (elen >= sizeof(struct ieee80211_tim_ie)) {
                                 elems->tim = (void *)pos;
                                 elems->tim_len = elen;
-                        }
+                        } else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_IBSS_PARAMS:
                         elems->ibss_params = pos;
@@ -664,10 +681,14 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                 case WLAN_EID_HT_CAPABILITY:
                         if (elen >= sizeof(struct ieee80211_ht_cap))
                                 elems->ht_cap_elem = (void *)pos;
+                        else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_HT_INFORMATION:
                         if (elen >= sizeof(struct ieee80211_ht_info))
                                 elems->ht_info_elem = (void *)pos;
+                        else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_MESH_ID:
                         elems->mesh_id = pos;
@@ -676,6 +697,8 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                 case WLAN_EID_MESH_CONFIG:
                         if (elen >= sizeof(struct ieee80211_meshconf_ie))
                                 elems->mesh_config = (void *)pos;
+                        else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_PEER_MGMT:
                         elems->peering = pos;
@@ -696,6 +719,8 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                 case WLAN_EID_RANN:
                         if (elen >= sizeof(struct ieee80211_rann_ie))
                                 elems->rann = (void *)pos;
+                        else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_CHANNEL_SWITCH:
                         elems->ch_switch_elem = pos;
@@ -724,10 +749,18 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         break;
                 }
 
+                if (elem_parse_failed)
+                        elems->parse_error = true;
+                else
+                        set_bit(id, seen_elems);
+
                 left -= elen;
                 pos += elen;
         }
 
+        if (left != 0)
+                elems->parse_error = true;
+
         return crc;
 }