From: Thomas Pedersen <thomas@adapt-ip.com>
To: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-wireless <linux-wireless@vger.kernel.org>,
Thomas Pedersen <thomas@adapt-ip.com>
Subject: [PATCH v2 04/22] nl80211: correctly validate S1G beacon head
Date: Mon, 31 Aug 2020 13:55:42 -0700 [thread overview]
Message-ID: <20200831205600.21058-5-thomas@adapt-ip.com> (raw)
In-Reply-To: <20200831205600.21058-1-thomas@adapt-ip.com>
The S1G beacon has a different header size than regular
beacons, so adjust the beacon head validator.
Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
---
net/wireless/nl80211.c | 16 +++++++++++++---
net/wireless/util.c | 5 +++++
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7da4d84bcc1a..3bf595c828db 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -209,14 +209,24 @@ static int validate_beacon_head(const struct nlattr *attr,
unsigned int len = nla_len(attr);
const struct element *elem;
const struct ieee80211_mgmt *mgmt = (void *)data;
- unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
- u.beacon.variable);
+ bool s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
+ unsigned int fixedlen, hdrlen;
+
+ if (s1g_bcn) {
+ fixedlen = offsetof(struct ieee80211_ext,
+ u.s1g_beacon.variable);
+ hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
+ } else {
+ fixedlen = offsetof(struct ieee80211_mgmt,
+ u.beacon.variable);
+ hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
+ }
if (len < fixedlen)
goto err;
if (ieee80211_hdrlen(mgmt->frame_control) !=
- offsetof(struct ieee80211_mgmt, u.beacon))
+ hdrlen)
goto err;
data += fixedlen;
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4a9ff9ef513f..49e7c0cbbf62 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -399,6 +399,11 @@ unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
{
unsigned int hdrlen = 24;
+ if (ieee80211_is_ext(fc)) {
+ hdrlen = 4;
+ goto out;
+ }
+
if (ieee80211_is_data(fc)) {
if (ieee80211_has_a4(fc))
hdrlen = 30;
--
2.20.1
next prev parent reply other threads:[~2020-08-31 20:56 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-31 20:55 [PATCH v2 00/22] add support for S1G association Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 01/22] ieee80211: redefine S1G bits with GENMASK Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 02/22] nl80211: advertise supported channel width in S1G Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 03/22] cfg80211: regulatory: handle S1G channels Thomas Pedersen
2020-09-05 18:38 ` Thomas Pedersen
2020-08-31 20:55 ` Thomas Pedersen [this message]
2020-08-31 20:55 ` [PATCH v2 05/22] nl80211: support setting " Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 06/22] {cfg,mac}80211: get correct default channel width for S1G Thomas Pedersen
2020-09-18 10:38 ` Johannes Berg
2020-09-21 4:59 ` Thomas Pedersen
2020-09-21 7:01 ` Johannes Berg
2020-09-21 16:26 ` Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 07/22] mac80211: s1g: choose scanning width based on frequency Thomas Pedersen
2020-09-18 10:40 ` Johannes Berg
2020-09-21 5:06 ` Thomas Pedersen
2020-09-21 6:58 ` Johannes Berg
2020-08-31 20:55 ` [PATCH v2 08/22] nl80211: support S1G capabilities Thomas Pedersen
2020-09-18 10:41 ` Johannes Berg
2020-09-18 10:47 ` Johannes Berg
2020-09-21 4:34 ` Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 09/22] mac80211: support S1G STA capabilities Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 10/22] cfg80211: convert S1G beacon to scan results Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 11/22] cfg80211: parse S1G Operation element for BSS channel Thomas Pedersen
2020-09-18 10:45 ` Johannes Berg
2020-09-21 5:12 ` Thomas Pedersen
2020-09-21 6:54 ` Johannes Berg
2020-08-31 20:55 ` [PATCH v2 12/22] mac80211: convert S1G beacon to scan results Thomas Pedersen
2020-09-18 10:48 ` Johannes Berg
2020-09-21 5:45 ` Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 13/22] cfg80211: handle Association Response from S1G STA Thomas Pedersen
2020-09-18 10:50 ` Johannes Berg
2020-09-21 5:52 ` Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 14/22] mac80211: encode listen interval for S1G Thomas Pedersen
2020-09-18 10:51 ` Johannes Berg
2020-09-21 5:56 ` Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 15/22] mac80211: don't calculate duration " Thomas Pedersen
2020-09-18 10:52 ` Johannes Berg
2020-09-18 10:55 ` Johannes Berg
2020-09-21 6:03 ` Thomas Pedersen
2020-09-21 6:51 ` Johannes Berg
2020-08-31 20:55 ` [PATCH v2 16/22] mac80211: handle S1G low rates Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 17/22] mac80211: avoid rate init for S1G band Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 18/22] mac80211: receive and process S1G beacons Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 19/22] mac80211: support S1G association Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 20/22] nl80211: include frequency offset in survey info Thomas Pedersen
2020-08-31 20:55 ` [PATCH v2 21/22] mac80211_hwsim: indicate support for S1G Thomas Pedersen
2020-09-06 8:49 ` [mac80211_hwsim] 8cafe19852: hwsim.fst_ap_config_default.fail kernel test robot
2020-09-08 18:00 ` Thomas Pedersen
2020-09-08 18:41 ` Johannes Berg
2020-09-08 18:53 ` Thomas Pedersen
2020-08-31 20:56 ` [PATCH v2 22/22] mac80211_hwsim: fix TSF timestamp write to S1G beacon Thomas Pedersen
2020-09-06 16:04 ` [PATCH v2 00/22] add support for S1G association Johannes Berg
2020-09-08 18:30 ` Thomas Pedersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200831205600.21058-5-thomas@adapt-ip.com \
--to=thomas@adapt-ip.com \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).