From: Johannes Berg <[email protected]>
In commit 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header
bitmap") we accidentally pointed the position to the wrong place, so
we overwrite a present bitmap, and thus cause all kinds of trouble.
To see the issue, note that the previous code read:
pos = (void *)(it_present + 1);
The requirement now is that we need to calculate pos via it_optional,
to not trigger the compiler hardening checks, as:
pos = (void *)&rthdr->it_optional[...];
Rewriting the original expression, we get (obviously, since that just
adds "+ x - x" terms):
pos = (void *)(it_present + 1 + rthdr->it_optional - rthdr->it_optional)
and moving the "+ rthdr->it_optional" outside to be used as an array:
pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
The original is off by one, fix it.
Cc: [email protected]
Fixes: 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header bitmap")
Reported-by: Sid Hayn <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>
---
net/mac80211/rx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fc5c608d02e2..3562730ea0f8 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
* the compiler to think we have walked past the end of the
* struct member.
*/
- pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional];
+ pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
/* the order of the following fields is important */
--
2.31.1
Please add my tested-by as well. I tested with and without this patch
on multiple chipsets and everything appears functional now. Thanks
for the quick fix!
Tested-by: Sid Hayn <[email protected]>
On Tue, Nov 9, 2021 at 4:02 AM Johannes Berg <[email protected]> wrote:
>
> From: Johannes Berg <[email protected]>
>
> In commit 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header
> bitmap") we accidentally pointed the position to the wrong place, so
> we overwrite a present bitmap, and thus cause all kinds of trouble.
>
> To see the issue, note that the previous code read:
>
> pos = (void *)(it_present + 1);
>
> The requirement now is that we need to calculate pos via it_optional,
> to not trigger the compiler hardening checks, as:
>
> pos = (void *)&rthdr->it_optional[...];
>
> Rewriting the original expression, we get (obviously, since that just
> adds "+ x - x" terms):
>
> pos = (void *)(it_present + 1 + rthdr->it_optional - rthdr->it_optional)
>
> and moving the "+ rthdr->it_optional" outside to be used as an array:
>
> pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
>
> The original is off by one, fix it.
>
> Cc: [email protected]
> Fixes: 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header bitmap")
> Reported-by: Sid Hayn <[email protected]>
> Signed-off-by: Johannes Berg <[email protected]>
> ---
> net/mac80211/rx.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
> index fc5c608d02e2..3562730ea0f8 100644
> --- a/net/mac80211/rx.c
> +++ b/net/mac80211/rx.c
> @@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
> * the compiler to think we have walked past the end of the
> * struct member.
> */
> - pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional];
> + pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
>
> /* the order of the following fields is important */
>
> --
> 2.31.1
>
On Tue, Nov 09, 2021 at 10:02:04AM +0100, Johannes Berg wrote:
> From: Johannes Berg <[email protected]>
>
> In commit 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header
> bitmap") we accidentally pointed the position to the wrong place, so
> we overwrite a present bitmap, and thus cause all kinds of trouble.
>
> To see the issue, note that the previous code read:
>
> pos = (void *)(it_present + 1);
>
> The requirement now is that we need to calculate pos via it_optional,
> to not trigger the compiler hardening checks, as:
>
> pos = (void *)&rthdr->it_optional[...];
>
> Rewriting the original expression, we get (obviously, since that just
> adds "+ x - x" terms):
>
> pos = (void *)(it_present + 1 + rthdr->it_optional - rthdr->it_optional)
>
> and moving the "+ rthdr->it_optional" outside to be used as an array:
>
> pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
>
> The original is off by one, fix it.
>
> Cc: [email protected]
> Fixes: 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header bitmap")
> Reported-by: Sid Hayn <[email protected]>
> Signed-off-by: Johannes Berg <[email protected]>
Argh! Thank you for the fix and sorry for the trouble the earlier patch
created!
Reviewed-by: Kees Cook <[email protected]>
-Kees
> ---
> net/mac80211/rx.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
> index fc5c608d02e2..3562730ea0f8 100644
> --- a/net/mac80211/rx.c
> +++ b/net/mac80211/rx.c
> @@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
> * the compiler to think we have walked past the end of the
> * struct member.
> */
> - pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional];
> + pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
>
> /* the order of the following fields is important */
>
> --
> 2.31.1
>
--
Kees Cook