wifi: cfg80211/mac80211: reject bad MBSSID elements

wifi: cfg80211/mac80211: reject bad MBSSID elements

commit 630b523ec4472d5914f6ba1a9750d1e8449cea59 upstream.

Per spec, the maximum value for the MaxBSSID ('n') indicator is 8,
and the minimum is 1 since a multiple BSSID set with just one BSSID
doesn't make sense (the # of BSSIDs is limited by 2^n).

Limit this in the parsing in both cfg80211 and mac80211, rejecting
any elements with an invalid value.

This fixes potentially bad shifts in the processing of these inside
the cfg80211_gen_new_bssid() function later.

I found this during the investigation of CVE-2022-41674 fixed by the
previous patch.

Fixes: ac2a324087a0 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Fixes: 7d7dcb365227 ("mac80211: support multi-bssid")
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>