From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
"Brian Norris" <briannorris@chromium.org>,
"Kalle Valo" <kvalo@codeaurora.org>,
"Takashi Iwai" <tiwai@suse.de>
Subject: [PATCH 3.16 22/47] mwifiex: Don't abort on small, spec-compliant vendor IEs
Date: Fri, 25 Oct 2019 19:03:23 +0100 [thread overview]
Message-ID: <lsq.1572026582.561095120@decadent.org.uk> (raw)
In-Reply-To: <lsq.1572026581.992411028@decadent.org.uk>
3.16.76-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <briannorris@chromium.org>
commit 63d7ef36103d26f20325a921ecc96a3288560146 upstream.
Per the 802.11 specification, vendor IEs are (at minimum) only required
to contain an OUI. A type field is also included in ieee80211.h (struct
ieee80211_vendor_ie) but doesn't appear in the specification. The
remaining fields (subtype, version) are a convention used in WMM
headers.
Thus, we should not reject vendor-specific IEs that have only the
minimum length (3 bytes) -- we should skip over them (since we only want
to match longer IEs, that match either WMM or WPA formats). We can
reject elements that don't have the minimum-required 3 byte OUI.
While we're at it, move the non-standard subtype and version fields into
the WMM structs, to avoid this confusion in the future about generic
"vendor header" attributes.
Fixes: 685c9b7750bf ("mwifiex: Abort at too short BSS descriptor element")
Cc: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.16: adjust filenames, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/wireless/mwifiex/fw.h | 12 +++++++++---
drivers/net/wireless/mwifiex/scan.c | 18 +++++++++++-------
drivers/net/wireless/mwifiex/sta_ioctl.c | 4 ++--
drivers/net/wireless/mwifiex/wmm.c | 2 +-
4 files changed, 23 insertions(+), 13 deletions(-)
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -1398,9 +1398,10 @@ struct mwifiex_ie_types_wmm_queue_status
struct ieee_types_vendor_header {
u8 element_id;
u8 len;
- u8 oui[4]; /* 0~2: oui, 3: oui_type */
- u8 oui_subtype;
- u8 version;
+ struct {
+ u8 oui[3];
+ u8 oui_type;
+ } __packed oui;
} __packed;
struct ieee_types_wmm_parameter {
@@ -1414,6 +1415,9 @@ struct ieee_types_wmm_parameter {
* Version [1]
*/
struct ieee_types_vendor_header vend_hdr;
+ u8 oui_subtype;
+ u8 version;
+
u8 qos_info_bitmap;
u8 reserved;
struct ieee_types_wmm_ac_parameters ac_params[IEEE80211_NUM_ACS];
@@ -1431,6 +1435,8 @@ struct ieee_types_wmm_info {
* Version [1]
*/
struct ieee_types_vendor_header vend_hdr;
+ u8 oui_subtype;
+ u8 version;
u8 qos_info_bitmap;
} __packed;
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1284,21 +1284,25 @@ int mwifiex_update_bss_desc_with_ie(stru
break;
case WLAN_EID_VENDOR_SPECIFIC:
- if (element_len + 2 < sizeof(vendor_ie->vend_hdr))
- return -EINVAL;
-
vendor_ie = (struct ieee_types_vendor_specific *)
current_ptr;
- if (!memcmp
- (vendor_ie->vend_hdr.oui, wpa_oui,
- sizeof(wpa_oui))) {
+ /* 802.11 requires at least 3-byte OUI. */
+ if (element_len < sizeof(vendor_ie->vend_hdr.oui.oui))
+ return -EINVAL;
+
+ /* Not long enough for a match? Skip it. */
+ if (element_len < sizeof(wpa_oui))
+ break;
+
+ if (!memcmp(&vendor_ie->vend_hdr.oui, wpa_oui,
+ sizeof(wpa_oui))) {
bss_entry->bcn_wpa_ie =
(struct ieee_types_vendor_specific *)
current_ptr;
bss_entry->wpa_offset = (u16)
(current_ptr - bss_entry->beacon_buf);
- } else if (!memcmp(vendor_ie->vend_hdr.oui, wmm_oui,
+ } else if (!memcmp(&vendor_ie->vend_hdr.oui, wmm_oui,
sizeof(wmm_oui))) {
if (total_ie_len ==
sizeof(struct ieee_types_wmm_parameter) ||
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -1318,7 +1318,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex
pvendor_ie = (struct ieee_types_vendor_header *) ie_data_ptr;
/* Test to see if it is a WPA IE, if not, then it is a gen IE */
if (((pvendor_ie->element_id == WLAN_EID_VENDOR_SPECIFIC) &&
- (!memcmp(pvendor_ie->oui, wpa_oui, sizeof(wpa_oui)))) ||
+ (!memcmp(&pvendor_ie->oui, wpa_oui, sizeof(wpa_oui)))) ||
(pvendor_ie->element_id == WLAN_EID_RSN)) {
/* IE is a WPA/WPA2 IE so call set_wpa function */
@@ -1343,7 +1343,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex
*/
pvendor_ie = (struct ieee_types_vendor_header *) ie_data_ptr;
if ((pvendor_ie->element_id == WLAN_EID_VENDOR_SPECIFIC) &&
- (!memcmp(pvendor_ie->oui, wps_oui, sizeof(wps_oui)))) {
+ (!memcmp(&pvendor_ie->oui, wps_oui, sizeof(wps_oui)))) {
priv->wps.session_enable = true;
dev_dbg(priv->adapter->dev,
"info: WPS Session Enabled.\n");
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -241,7 +241,7 @@ mwifiex_wmm_setup_queue_priorities(struc
dev_dbg(priv->adapter->dev, "info: WMM Parameter IE: version=%d, "
"qos_info Parameter Set Count=%d, Reserved=%#x\n",
- wmm_ie->vend_hdr.version, wmm_ie->qos_info_bitmap &
+ wmm_ie->version, wmm_ie->qos_info_bitmap &
IEEE80211_WMM_IE_AP_QOSINFO_PARAM_SET_CNT_MASK,
wmm_ie->reserved);
next prev parent reply other threads:[~2019-10-25 18:08 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-25 18:03 [PATCH 3.16 00/47] 3.16.76-rc1 review Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 01/47] eCryptfs: fix a couple type promotion bugs Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 02/47] ARM: riscpc: fix DMA Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 03/47] 9p/virtio: Add cleanup path in p9_virtio_init Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 04/47] tty: serial: cpm_uart - fix init when SMC is relocated Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 05/47] signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 06/47] xfrm: Fix xfrm sel prefix length validation Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 07/47] af_key: fix leaks in key_pol_get_resp and dump_sp Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 08/47] crypto: talitos - check AES key size Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 09/47] crypto: ghash - fix unaligned memory access in ghash_setkey() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 10/47] s390/qdio: handle PENDING state for QEBSM devices Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 11/47] memstick: Fix error cleanup path of memstick_init Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 12/47] gpio: omap: fix lack of irqstatus_raw0 for OMAP4 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 13/47] xfrm: fix sa selector validation Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 14/47] PCI: Do not poll for PME if the device is in D3cold Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 15/47] usb: gadget: ether: Fix race between gether_disconnect and rx_submit Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 16/47] powerpc/32s: fix suspend/resume when IBATs 4-7 are used Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 17/47] powerpc/watchpoint: Restore NV GPRs while returning from exception Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 18/47] USB: serial: option: add GosunCn ZTE WeLink ME3630 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 19/47] USB: serial: option: add support for GosunCn ME3630 RNDIS mode Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 20/47] s390: fix stfle zero padding Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 21/47] VMCI: Fix integer overflow in VMCI handle arrays Ben Hutchings
2019-10-25 18:03 ` Ben Hutchings [this message]
2019-10-25 18:03 ` [PATCH 3.16 23/47] mwifiex: fix 802.11n/WPA detection Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 24/47] media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 25/47] EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 26/47] carl9170: fix misuse of device driver API Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 27/47] x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 28/47] x86/tls: Fix possible spectre-v1 in do_get_thread_area() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 29/47] USB: serial: ftdi_sio: add ID for isodebug v1 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 30/47] igmp: fix memory leak in igmpv3_del_delrec() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 31/47] s390/qdio: (re-)initialize tiqdio list entries Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 32/47] s390/qdio: don't touch the dsci in tiqdio_add_input_queues() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 33/47] net: bridge: stp: don't cache eth dest pointer before skb pull Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 34/47] lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 35/47] bonding: validate ip header before check IPPROTO_IGMP Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 36/47] NFSv4: Handle the special Linux file open access mode Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 37/47] ARC: hide unused function unw_hdr_alloc Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 38/47] udf: Fix incorrect final NOT_ALLOCATED (hole) extent length Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 39/47] mm/mmu_notifier: use hlist_add_head_rcu() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 40/47] net: neigh: fix multiple neigh timer scheduling Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 41/47] ALSA: seq: Break too long mutex context in the write loop Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 42/47] coda: pass the host file in vma->vm_file on mmap Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 43/47] caif-hsi: fix possible deadlock in cfhsi_exit_module() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 44/47] parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 45/47] padata: use smp_mb in padata_reorder to avoid orphaned padata jobs Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 46/47] Input: psmouse - fix build error of multiple definition Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 47/47] KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed Ben Hutchings
2019-10-25 19:05 ` Joe Perches
2019-10-31 22:14 ` Ben Hutchings
2019-10-31 22:53 ` Joe Perches
2019-10-31 22:56 ` Paolo Bonzini
2019-11-01 8:07 ` Sasha Levin
2019-11-01 15:40 ` Joe Perches
2019-11-02 7:39 ` Sasha Levin
2019-10-26 1:35 ` [PATCH 3.16 00/47] 3.16.76-rc1 review Guenter Roeck
2019-10-26 18:00 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1572026582.561095120@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=briannorris@chromium.org \
--cc=kda@linux-powerpc.org \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).