From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ilan Peer <ilan.peer@intel.com>,
Luca Coelho <luciano.coelho@intel.com>,
Johannes Berg <johannes.berg@intel.com>,
Sasha Levin <sashal@kernel.org>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.20 207/304] mac80211: Properly handle SKB with radiotap only
Date: Mon, 28 Jan 2019 10:42:04 -0500 [thread overview]
Message-ID: <20190128154341.47195-207-sashal@kernel.org> (raw)
In-Reply-To: <20190128154341.47195-1-sashal@kernel.org>
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 8020919a9b99d6c990dc6a50e8215e291fbbe5a6 ]
The monitor interface Rx handling of SKBs that contain only
radiotap information was buggy as it tried to access the
SKB assuming it contains a frame.
To fix this, check the RX_FLAG_NO_PSDU flag in the Rx status
(indicting that the SKB contains only radiotap information),
and do not perform data path specific processing when the flag
is set.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/rx.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 428f7ad5f9b5..77d996a60f12 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -753,6 +753,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
struct ieee80211_sub_if_data *monitor_sdata =
rcu_dereference(local->monitor_sdata);
bool only_monitor = false;
+ unsigned int min_head_len;
if (status->flag & RX_FLAG_RADIOTAP_HE)
rtap_space += sizeof(struct ieee80211_radiotap_he);
@@ -766,6 +767,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
rtap_space += sizeof(*rtap) + rtap->len + rtap->pad;
}
+ min_head_len = rtap_space;
+
/*
* First, we may need to make a copy of the skb because
* (1) we need to modify it for radiotap (if not present), and
@@ -775,18 +778,23 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
* the SKB because it has a bad FCS/PLCP checksum.
*/
- if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
- if (unlikely(origskb->len <= FCS_LEN)) {
- /* driver bug */
- WARN_ON(1);
- dev_kfree_skb(origskb);
- return NULL;
+ if (!(status->flag & RX_FLAG_NO_PSDU)) {
+ if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
+ if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
+ /* driver bug */
+ WARN_ON(1);
+ dev_kfree_skb(origskb);
+ return NULL;
+ }
+ present_fcs_len = FCS_LEN;
}
- present_fcs_len = FCS_LEN;
+
+ /* also consider the hdr->frame_control */
+ min_head_len += 2;
}
- /* ensure hdr->frame_control and vendor radiotap data are in skb head */
- if (!pskb_may_pull(origskb, 2 + rtap_space)) {
+ /* ensure that the expected data elements are in skb head */
+ if (!pskb_may_pull(origskb, min_head_len)) {
dev_kfree_skb(origskb);
return NULL;
}
--
2.19.1
next prev parent reply other threads:[~2019-01-28 17:38 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20190128154341.47195-1-sashal@kernel.org>
2019-01-28 15:38 ` [PATCH AUTOSEL 4.20 015/304] wil6210: fix reset flow for Talyn-mb Sasha Levin
2019-01-28 15:38 ` [PATCH AUTOSEL 4.20 016/304] wil6210: fix memory leak in wil_find_tx_bcast_2 Sasha Levin
2019-01-28 15:38 ` [PATCH AUTOSEL 4.20 017/304] ath10k: assign 'n_cipher_suites' for WCN3990 Sasha Levin
2019-01-28 15:38 ` [PATCH AUTOSEL 4.20 018/304] ath9k: dynack: use authentication messages for 'late' ack Sasha Levin
2019-01-28 15:39 ` [PATCH AUTOSEL 4.20 041/304] iwlwifi: fw: do not set sgi bits for HE connection Sasha Levin
2019-01-28 15:40 ` [PATCH AUTOSEL 4.20 104/304] mt76x0: dfs: fix IBI_R11 configuration on non-radar channels Sasha Levin
2019-01-28 15:40 ` [PATCH AUTOSEL 4.20 105/304] mt76x0: use band parameter for LC calibration Sasha Levin
2019-01-28 15:40 ` [PATCH AUTOSEL 4.20 127/304] mac80211: fix deauth TX when we disconnect Sasha Levin
2019-01-28 15:42 ` Sasha Levin [this message]
2019-01-28 15:42 ` [PATCH AUTOSEL 4.20 223/304] mac80211: fix radiotap vendor presence bitmap handling Sasha Levin
2019-01-28 15:42 ` [PATCH AUTOSEL 4.20 229/304] cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() Sasha Levin
2019-01-28 15:42 ` [PATCH AUTOSEL 4.20 234/304] iwlwifi: mvm: fix setting HE ppe FW config Sasha Levin
2019-01-28 15:42 ` [PATCH AUTOSEL 4.20 241/304] ath10k: fix kernel panic due to use after free Sasha Levin
2019-01-28 15:42 ` [PATCH AUTOSEL 4.20 242/304] ath10k: fix tx_stats memory leak Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190128154341.47195-207-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ilan.peer@intel.com \
--cc=johannes.berg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=luciano.coelho@intel.com \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).