Received: by 2002:a25:d7c1:0:0:0:0:0 with SMTP id o184csp2237708ybg; Sun, 27 Oct 2019 14:06:56 -0700 (PDT) X-Google-Smtp-Source: APXvYqz8Am6CU7QvXwgWTk5UbTA+wMosIXfPpo1d9XHP7XfbY3OEh7qStyaqyHv76HhbatzUtrbl X-Received: by 2002:a17:906:3501:: with SMTP id r1mr7879185eja.301.1572210416684; Sun, 27 Oct 2019 14:06:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1572210416; cv=none; d=google.com; s=arc-20160816; b=QfYMmCpln85RUDF08OGF76sBRhrscA26w8NhA2fMIRecOSJgZpLcPC84m/6j72zrJZ R2SKGgr9pzAGDH7dvCfyal9ZtpkbwEX8wUhJYbyhfBlC3zPRYAo4PrZfPiy+37f32SVA y87YaNX87dAv+dkfjVvxhqovI2n+IaTOaVVtR0IRkeFpeMhRSk11PFSU6RI2lYwM1m78 blhcDz0IsH8REztrn2amMReg25OjdQYtVYDlQfQZ/SAGdaJcDdW8d9VY9hraGiufCZaG rP487ZSfLRt6DO1ktjtOFKMMYD9iFiO7Xd8p9Td+Qi5NolB0PsO3o5WYBGB/ZKl5TLHr phug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=UEC4RngwhnIVS4ko+Wqc1ynBOCKwxUL9RhM2cBo8N/Q=; b=EdCS4dTglLj8z49An2syqHjV98wJd7QIQaZ//3YZZwW2Ot6npfvub82MnWiExevXIh 5zcUzJ3unP8mLs3hua2nqztznxIGdzi5YQBfAszJZ5pAuGHmFpAor5aJXfFGKKcxbLzG N7jiR2E3t2FDu2wVt4TnUY1BimMzVFLU6nqBP1wDPEhLdhiQKfmXf1Tp/rbBjLN3CISp P+AcT9okM0P+/d/UrsjNmDgJCXe899YSsOvDsK2Jzb3DV/6kkCxbBDuiQNhMLZRvkBYr GTXsHYSvFqDcj29oWaGbYC4fnN4LTNCdUeNw2jyPbBo9RkSh/2LdW4J6Wckr/2LxpfHX 50EQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=RYfl1NfN; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j12si6220843eda.406.2019.10.27.14.06.33; Sun, 27 Oct 2019 14:06:56 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=RYfl1NfN; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728565AbfJ0VEK (ORCPT + 99 others); Sun, 27 Oct 2019 17:04:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:49788 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728556AbfJ0VEI (ORCPT ); Sun, 27 Oct 2019 17:04:08 -0400 Received: from localhost (100.50.158.77.rev.sfr.net [77.158.50.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B3A2220B7C; Sun, 27 Oct 2019 21:04:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572210248; bh=uMocm4+Idqizp2zaiVTkONT4tZfh/ZwZSSAhrI2oUFI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RYfl1NfNfQxdZigvbs9Vm6iprtWv0Z4N3j8t7PG12EB/vbyXIp53zAo/+8cRqBwdT 44GnGNdf2YVS9VO3XFNANkmRBhArYNlewBLcf5U6yrE7wZTmBBQfcQ5qnc/yF4Y/DD xOKnsfgZbtNmY0OeVIfDfyXMAZvirP5JYz98BmSQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Nicolas Waisman , Will Deacon , Johannes Berg Subject: [PATCH 4.4 28/41] mac80211: Reject malformed SSID elements Date: Sun, 27 Oct 2019 22:01:06 +0100 Message-Id: <20191027203123.346468408@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191027203056.220821342@linuxfoundation.org> References: <20191027203056.220821342@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Will Deacon commit 4152561f5da3fca92af7179dd538ea89e248f9d0 upstream. Although this shouldn't occur in practice, it's a good idea to bounds check the length field of the SSID element prior to using it for things like allocations or memcpy operations. Cc: Cc: Kees Cook Reported-by: Nicolas Waisman Signed-off-by: Will Deacon Link: https://lore.kernel.org/r/20191004095132.15777-1-will@kernel.org Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/mlme.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -2431,7 +2431,8 @@ struct sk_buff *ieee80211_ap_probereq_ge rcu_read_lock(); ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID); - if (WARN_ON_ONCE(ssid == NULL)) + if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN, + "invalid SSID element (len=%d)", ssid ? ssid[1] : -1)) ssid_len = 0; else ssid_len = ssid[1]; @@ -4669,7 +4670,7 @@ int ieee80211_mgd_assoc(struct ieee80211 rcu_read_lock(); ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID); - if (!ssidie) { + if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) { rcu_read_unlock(); kfree(assoc_data); return -EINVAL;