All of lore.kernel.org
 help / color / mirror / Atom feed
From: Luca Coelho <luca@coelho.fi>
To: johannes@sipsolutions.net
Cc: luca@coelho.fi, linux-wireless@vger.kernel.org
Subject: [PATCH 20/31] mac80211: handle various extensible elements correctly
Date: Fri, 18 Jun 2021 13:41:45 +0300	[thread overview]
Message-ID: <iwlwifi.20210618133832.cd101f8040a4.Iadf0e9b37b100c6c6e79c7b298cc657c2be9151a@changeid> (raw)
In-Reply-To: <20210618104156.747775-1-luca@coelho.fi>

From: Johannes Berg <johannes.berg@intel.com>

Various elements are parsed with a requirement to have an
exact size, when really we should only check that they have
the minimum size that we need. Check only that and therefore
ignore any additional data that they might carry.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/mac80211/util.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 08530da5ac05..c4aff6743552 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -947,7 +947,7 @@ static void ieee80211_parse_extension_element(u32 *crc,
 
 	switch (elem->data[0]) {
 	case WLAN_EID_EXT_HE_MU_EDCA:
-		if (len == sizeof(*elems->mu_edca_param_set)) {
+		if (len >= sizeof(*elems->mu_edca_param_set)) {
 			elems->mu_edca_param_set = data;
 			if (crc)
 				*crc = crc32_be(*crc, (void *)elem,
@@ -968,7 +968,7 @@ static void ieee80211_parse_extension_element(u32 *crc,
 		}
 		break;
 	case WLAN_EID_EXT_UORA:
-		if (len == 1)
+		if (len >= 1)
 			elems->uora_element = data;
 		break;
 	case WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME:
@@ -976,7 +976,7 @@ static void ieee80211_parse_extension_element(u32 *crc,
 			elems->max_channel_switch_time = data;
 		break;
 	case WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION:
-		if (len == sizeof(*elems->mbssid_config_ie))
+		if (len >= sizeof(*elems->mbssid_config_ie))
 			elems->mbssid_config_ie = data;
 		break;
 	case WLAN_EID_EXT_HE_SPR:
@@ -985,7 +985,7 @@ static void ieee80211_parse_extension_element(u32 *crc,
 			elems->he_spr = data;
 		break;
 	case WLAN_EID_EXT_HE_6GHZ_CAPA:
-		if (len == sizeof(*elems->he_6ghz_capa))
+		if (len >= sizeof(*elems->he_6ghz_capa))
 			elems->he_6ghz_capa = data;
 		break;
 	}
@@ -1074,14 +1074,14 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 
 		switch (id) {
 		case WLAN_EID_LINK_ID:
-			if (elen + 2 != sizeof(struct ieee80211_tdls_lnkie)) {
+			if (elen + 2 < sizeof(struct ieee80211_tdls_lnkie)) {
 				elem_parse_failed = true;
 				break;
 			}
 			elems->lnk_id = (void *)(pos - 2);
 			break;
 		case WLAN_EID_CHAN_SWITCH_TIMING:
-			if (elen != sizeof(struct ieee80211_ch_switch_timing)) {
+			if (elen < sizeof(struct ieee80211_ch_switch_timing)) {
 				elem_parse_failed = true;
 				break;
 			}
@@ -1244,7 +1244,7 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 			elems->sec_chan_offs = (void *)pos;
 			break;
 		case WLAN_EID_CHAN_SWITCH_PARAM:
-			if (elen !=
+			if (elen <
 			    sizeof(*elems->mesh_chansw_params_ie)) {
 				elem_parse_failed = true;
 				break;
@@ -1253,7 +1253,7 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 			break;
 		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
 			if (!action ||
-			    elen != sizeof(*elems->wide_bw_chansw_ie)) {
+			    elen < sizeof(*elems->wide_bw_chansw_ie)) {
 				elem_parse_failed = true;
 				break;
 			}
@@ -1272,7 +1272,7 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 			ie = cfg80211_find_ie(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
 					      pos, elen);
 			if (ie) {
-				if (ie[1] == sizeof(*elems->wide_bw_chansw_ie))
+				if (ie[1] >= sizeof(*elems->wide_bw_chansw_ie))
 					elems->wide_bw_chansw_ie =
 						(void *)(ie + 2);
 				else
@@ -1316,7 +1316,7 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 			elems->cisco_dtpc_elem = pos;
 			break;
 		case WLAN_EID_ADDBA_EXT:
-			if (elen != sizeof(struct ieee80211_addba_ext_ie)) {
+			if (elen < sizeof(struct ieee80211_addba_ext_ie)) {
 				elem_parse_failed = true;
 				break;
 			}
@@ -1342,7 +1342,7 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 							  elem, elems);
 			break;
 		case WLAN_EID_S1G_CAPABILITIES:
-			if (elen == sizeof(*elems->s1g_capab))
+			if (elen >= sizeof(*elems->s1g_capab))
 				elems->s1g_capab = (void *)pos;
 			else
 				elem_parse_failed = true;
-- 
2.32.0


  parent reply	other threads:[~2021-06-18 11:09 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-18 10:41 [PATCH 00/31] cfg80211/mac80211 patches from our internal tree 2021-06-18 Luca Coelho
2021-06-18 10:41 ` [PATCH 01/31] mac80211: add HE 6GHz cap IE in 6GHz band only Luca Coelho
2021-06-18 10:41 ` [PATCH 02/31] mac80211: do not add twice the HE 6GHz cap IE Luca Coelho
2021-06-18 17:14   ` Florian Fainelli
2021-06-18 20:17     ` Luca Coelho
2021-06-23 11:04       ` Luca Coelho
2021-06-18 10:41 ` [PATCH 03/31] ieee80211: define timing measurement in extended capabilities IE Luca Coelho
2021-06-18 10:41 ` [PATCH 04/31] cfg80211: make certificate generation more robust Luca Coelho
2021-06-18 10:41 ` [PATCH 05/31] mac80211: handle rate control (RC) racing with chanctx definition Luca Coelho
2021-06-18 10:41 ` [PATCH 06/31] cfg80211: avoid double free of PMSR request Luca Coelho
2021-06-18 10:41 ` [PATCH 07/31] mac80211: allow SMPS requests only in client mode Luca Coelho
2021-06-18 10:41 ` [PATCH 08/31] mac80211: free skb in WEP error case Luca Coelho
2021-06-18 10:41 ` [PATCH 09/31] mac80211: move SMPS mode setting after ieee80211_prep_connection Luca Coelho
2021-06-18 10:41 ` [PATCH 10/31] mac80211: add to bss_conf if broadcast TWT is supported Luca Coelho
2021-06-18 10:41 ` [PATCH 11/31] nl80211/cfg80211: add BSS color to NDP ranging parameters Luca Coelho
2021-06-18 10:41 ` [PATCH 12/31] mac80211: Properly WARN on HW scan before restart Luca Coelho
2021-06-18 10:41 ` [PATCH 13/31] ieee80211: add defines for HE PHY cap byte 10 Luca Coelho
2021-06-18 10:41 ` [PATCH 14/31] cfg80211: add cfg80211_any_usable_channels() Luca Coelho
2021-06-18 10:41 ` [PATCH 15/31] mac80211: conditionally advertise HE in probe requests Luca Coelho
2021-06-18 10:41 ` [PATCH 16/31] cfg80211: Support hidden AP discovery over 6GHz band Luca Coelho
2021-06-18 10:41 ` [PATCH 17/31] mac80211: always include HE 6GHz capability in probe request Luca Coelho
2021-06-18 10:41 ` [PATCH 18/31] mac80211: always include HE 6GHz capability in assoc request Luca Coelho
2021-06-18 10:41 ` [PATCH 19/31] mac80211: rearrange struct txq_info for fewer holes Luca Coelho
2021-06-18 10:41 ` Luca Coelho [this message]
2021-06-18 10:41 ` [PATCH 21/31] cfg80211: set custom regdomain after wiphy registration Luca Coelho
2021-06-18 10:41 ` [PATCH 22/31] mac80211: improve AP disconnect message Luca Coelho
2021-06-18 10:41 ` [PATCH 23/31] cfg80211: trace more information in assoc trace event Luca Coelho
2021-06-18 10:41 ` [PATCH 24/31] mac80211: reset profile_periodicity/ema_ap Luca Coelho
2021-06-18 10:41 ` [PATCH 25/31] mac80211: remove use of ieee80211_get_he_sta_cap() Luca Coelho
2021-06-18 10:41 ` [PATCH 26/31] cfg80211: remove ieee80211_get_he_sta_cap() Luca Coelho
2021-06-18 10:41 ` [PATCH 27/31] cfg80211: allow advertising vendor-specific capabilities Luca Coelho
2021-06-18 10:41 ` [PATCH 28/31] mac80211: add vendor-specific capabilities to assoc request Luca Coelho
2021-06-18 10:41 ` [PATCH 29/31] mac8021: Allow probe request injection on passive non radar channels Luca Coelho
2021-06-18 10:41 ` [PATCH 30/31] mac80211: notify driver on mgd TX completion Luca Coelho
2021-06-18 10:41 ` [PATCH 31/31] cfg80211: reg: improve bad regulatory warning Luca Coelho

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=iwlwifi.20210618133832.cd101f8040a4.Iadf0e9b37b100c6c6e79c7b298cc657c2be9151a@changeid \
    --to=luca@coelho.fi \
    --cc=johannes@sipsolutions.net \
    --cc=linux-wireless@vger.kernel.org \
    --subject='Re: [PATCH 20/31] mac80211: handle various extensible elements correctly' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.