wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation

JIRA: https://issues.redhat.com/browse/RHEL-89168
CVE: CVE-2025-37973

commit 023c1f2
Author: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Date:   Thu Apr 24 18:01:42 2025 +0530

    wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
    
    Currently during the multi-link element defragmentation process, the
    multi-link element length added to the total IEs length when calculating
    the length of remaining IEs after the multi-link element in
    cfg80211_defrag_mle(). This could lead to out-of-bounds access if the
    multi-link element or its corresponding fragment elements are the last
    elements in the IEs buffer.
    
    To address this issue, correctly calculate the remaining IEs length by
    deducting the multi-link element end offset from total IEs end offset.
    
    Cc: stable@vger.kernel.org
    Fixes: 2481b5d ("wifi: cfg80211: handle BSS data contained in ML probe responses")
    Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
    Link: https://patch.msgid.link/20250424-fix_mle_defragmentation_oob_access-v1-1-84412a1743fa@quicinc.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>

Author: jtornosm

net/wireless/scan.c

@@ -2681,7 +2681,7 @@ cfg80211_defrag_mle(const struct element *mle, const u8 *ie, size_t ielen,
 	/* Required length for first defragmentation */
 	buf_len = mle->datalen - 1;
 	for_each_element(elem, mle->data + mle->datalen,
-			 ielen - sizeof(*mle) + mle->datalen) {
+			 ie + ielen - mle->data - mle->datalen) {
 		if (elem->id != WLAN_EID_FRAGMENT)
 			break;