shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 18:41:58 +09:00
Code Issues Packages Projects Releases Wiki Activity

wifi: cfg80211: check A-MSDU format more carefully

Browse Source 
[ Upstream commit 9ad7974856926129f190ffbe3beea78460b3b7cc ]

If it looks like there's another subframe in the A-MSDU
but the header isn't fully there, we can end up reading
data out of bounds, only to discard later. Make this a
bit more careful and check if the subframe header can
even be present.

Reported-by: syzbot+d050d437fe47d479d210@syzkaller.appspotmail.com
Link: https://msgid.link/20240226203405.a731e2c95e38.I82ce7d8c0cc8970ce29d0a39fdc07f1ffc425be4@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Johannes Berg
2024-02-26 20:34:06 +01:00
committed by Greg Kroah-Hartman
parent 966d5c2c22
commit 9eb3bc0973
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
net/wireless/util.c
View File

@@ -778,15 +778,19 @@ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr) bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr)
{ {
int offset = 0, remaining, subframe_len, padding; int offset = 0, subframe_len, padding;
for (offset = 0; offset < skb->len; offset += subframe_len + padding) { for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
int remaining = skb->len - offset;
struct { struct {
__be16 len; __be16 len;
u8 mesh_flags; u8 mesh_flags;
} hdr; } hdr;
u16 len; u16 len;
if (sizeof(hdr) > remaining)
return false;
if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0) if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0)
return false; return false;
@@ -798,7 +802,6 @@ bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr)
subframe_len = sizeof(struct ethhdr) + len; subframe_len = sizeof(struct ethhdr) + len;
padding = (4 - subframe_len) & 0x3; padding = (4 - subframe_len) & 0x3;
remaining = skb->len - offset;
if (subframe_len > remaining) if (subframe_len > remaining)
return false; return false;
@@ -816,7 +819,7 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
{ {
unsigned int hlen = ALIGN(extra_headroom, 4); unsigned int hlen = ALIGN(extra_headroom, 4);
struct sk_buff *frame = NULL; struct sk_buff *frame = NULL;
int offset = 0, remaining; int offset = 0;
struct { struct {
struct ethhdr eth; struct ethhdr eth;
uint8_t flags; uint8_t flags;
@@ -830,10 +833,14 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
copy_len = sizeof(hdr); copy_len = sizeof(hdr);
while (!last) { while (!last) {
int remaining = skb->len - offset;
unsigned int subframe_len; unsigned int subframe_len;
int len, mesh_len = 0; int len, mesh_len = 0;
u8 padding; u8 padding;
if (copy_len > remaining)
goto purge;
skb_copy_bits(skb, offset, &hdr, copy_len); skb_copy_bits(skb, offset, &hdr, copy_len);
if (iftype == NL80211_IFTYPE_MESH_POINT) if (iftype == NL80211_IFTYPE_MESH_POINT)
mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags); mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags);
@@ -846,7 +853,6 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
padding = (4 - subframe_len) & 0x3; padding = (4 - subframe_len) & 0x3;
/* the last MSDU has no padding */ /* the last MSDU has no padding */
remaining = skb->len - offset;
if (subframe_len > remaining) if (subframe_len > remaining)
goto purge; goto purge;
/* mitigate A-MSDU aggregation injection attacks */ /* mitigate A-MSDU aggregation injection attacks */