ieee80211: add helper to check HE capability element size

This element has a very dynamic structure, create a small helper
function to validate its size. We're currently checking it in
mac80211 in a conversion function, but that's actually slightly
buggy.

Link: https://lore.kernel.org/r/20220214172920.750bee9eaf37.Ie18359bd38143b7dc949078f10752413e6d36854@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 60b16bd0e255b128b3b3ca1e1816b3867e7705bb..896977e7f4c1fd74da8c7997ef45e1a33c64d62a 100644 (file)
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -9,7 +9,7 @@
  * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
  * Copyright (c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright (c) 2018 - 2021 Intel Corporation
+ * Copyright (c) 2018 - 2022 Intel Corporation
  */
 
 #ifndef __LINUX_IEEE80211_H
@@ -2357,6 +2357,29 @@ ieee80211_he_ppe_size(u8 ppe_thres_hdr, const u8 *phy_cap_info)
        return n;
 }
 
+static inline bool ieee80211_he_capa_size_ok(const u8 *data, u8 len)
+{
+       const struct ieee80211_he_cap_elem *he_cap_ie_elem = (const void *)data;
+       u8 needed = sizeof(*he_cap_ie_elem);
+
+       if (len < needed)
+               return false;
+
+       needed += ieee80211_he_mcs_nss_size(he_cap_ie_elem);
+       if (len < needed)
+               return false;
+
+       if (he_cap_ie_elem->phy_cap_info[6] &
+                       IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
+               if (len < needed + 1)
+                       return false;
+               needed += ieee80211_he_ppe_size(data[needed],
+                                               he_cap_ie_elem->phy_cap_info);
+       }
+
+       return len >= needed;
+}
+
 /* HE Operation defines */
 #define IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK           0x00000007
 #define IEEE80211_HE_OPERATION_TWT_REQUIRED                    0x00000008