cfg80211 validates WEXT IE buffers to stop OOB reads

Linux’s cfg80211 wireless stack is gaining a defensive check on the legacy Wireless Extensions path that accepts generic Information Element (IE) data from userspace.

Without validation, a malformed IE buffer could be stored via the SIOCSIWGENIE ioctl and only examined later, when a connection attempt (SIOCSIWESSID) asked cfg80211 to build association IEs. That path could read past the end of a tiny buffer while walking IE length fields, and an integer underflow in a subsequent copy size could wrap to a huge length and trip a fortify panic.

Deepanshu Kartikey fixed the issue by rejecting bad IE buffers at store time, before they ever reach the connection path. The bug was found by syzbot; wireless maintainer Johannes Berg took the change. Sasha Levin is auto-selecting it for stable backports across long-supported kernel series, so systems still exposing the old WEXT interfaces pick up the hardening without waiting for a full upgrade.

The WEXT ioctls remain a compatibility surface for older tools. Validating untrusted IE blobs at the boundary closes a crash class that did not require a full modern nl80211 client to trigger.