If the target nontransmitted BSSID profile is found, the outer for-loop should be broken, otherwise the "profile_len" might be incorrectly overwritten. Fixes: 5023b14cf4df ("mac80211: support profile split between elements") Signed-off-by: Michael-CY Lee <michael-cy.lee@xxxxxxxxxxxx> --- net/mac80211/parse.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c index 96584b39215e..a985a439051a 100644 --- a/net/mac80211/parse.c +++ b/net/mac80211/parse.c @@ -815,6 +815,9 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len, break; } } + + if (found) + break; } return found ? profile_len : 0; -- 2.25.1