From c4fc1bf2fd7fe6bebf72d32385bc2bd20d144093 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 18 May 2026 15:45:15 +0300 Subject: [PATCH 4/5] AP MLD: Verify AP MLD link ID validity before updating bitmap of links Link ID is 0..14, so ignore value 15 if an invalid frame is processed. It does not look like the invalid value was actually used to reference any local array, but in any case, it is better to not mark an invalid link as being specified. Signed-off-by: Jouni Malinen --- src/ap/beacon.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/ap/beacon.c b/src/ap/beacon.c index cec0c9829fd9..cc295c18f61b 100644 --- a/src/ap/beacon.c +++ b/src/ap/beacon.c @@ -1305,6 +1305,7 @@ static bool parse_ml_probe_req(const struct ieee80211_eht_ml *ml, size_t ml_len, for_each_element_id(sub, 0, pos, len) { const struct ieee80211_eht_per_sta_profile *sta; u16 sta_control; + u8 link_id; if (*links == 0xffff) *links = 0; @@ -1324,7 +1325,9 @@ static bool parse_ml_probe_req(const struct ieee80211_eht_ml *ml, size_t ml_len, * partial profile was requested. */ sta_control = le_to_host16(sta->sta_control); - *links |= BIT(sta_control & EHT_PER_STA_CTRL_LINK_ID_MSK); + link_id = sta_control & BASIC_MLE_STA_CTRL_LINK_ID_MASK; + if (link_id < MAX_NUM_MLD_LINKS) + *links |= BIT(link_id); } if (!for_each_element_completed(sub, pos, len)) { -- 2.43.0