2020-09-08 19:05:35

by Thomas Pedersen

[permalink] [raw]
Subject: [PATCH v3 04/22] nl80211: correctly validate S1G beacon head

The S1G beacon has a different header size than regular
beacons, so adjust the beacon head validator.

Signed-off-by: Thomas Pedersen <[email protected]>
---
net/wireless/nl80211.c | 16 +++++++++++++---
net/wireless/util.c | 5 +++++
2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e408624018d5..8cf50bfedb01 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -209,14 +209,24 @@ static int validate_beacon_head(const struct nlattr *attr,
unsigned int len = nla_len(attr);
const struct element *elem;
const struct ieee80211_mgmt *mgmt = (void *)data;
- unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
- u.beacon.variable);
+ bool s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
+ unsigned int fixedlen, hdrlen;
+
+ if (s1g_bcn) {
+ fixedlen = offsetof(struct ieee80211_ext,
+ u.s1g_beacon.variable);
+ hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
+ } else {
+ fixedlen = offsetof(struct ieee80211_mgmt,
+ u.beacon.variable);
+ hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
+ }

if (len < fixedlen)
goto err;

if (ieee80211_hdrlen(mgmt->frame_control) !=
- offsetof(struct ieee80211_mgmt, u.beacon))
+ hdrlen)
goto err;

data += fixedlen;
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 7c5d5365a5eb..11822cd05a9f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -397,6 +397,11 @@ unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
{
unsigned int hdrlen = 24;

+ if (ieee80211_is_ext(fc)) {
+ hdrlen = 4;
+ goto out;
+ }
+
if (ieee80211_is_data(fc)) {
if (ieee80211_has_a4(fc))
hdrlen = 30;
--
2.20.1


2020-09-18 10:58:53

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH v3 04/22] nl80211: correctly validate S1G beacon head

On Tue, 2020-09-08 at 12:03 -0700, Thomas Pedersen wrote:
> The S1G beacon has a different header size than regular
> beacons, so adjust the beacon head validator.

I've applied this already and will keep it, but you later add short
beacons - don't they need further adjustments here too?

johannes

2020-09-18 17:49:35

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH v3 04/22] nl80211: correctly validate S1G beacon head

On Fri, 2020-09-18 at 10:45 -0700, Thomas Pedersen wrote:
> On 2020-09-18 03:56, Johannes Berg wrote:
> > On Tue, 2020-09-08 at 12:03 -0700, Thomas Pedersen wrote:
> > > The S1G beacon has a different header size than regular
> > > beacons, so adjust the beacon head validator.
> >
> > I've applied this already and will keep it, but you later add short
> > beacons - don't they need further adjustments here too?
>
> Yes, but I was planning on doing that in the (yet to be submitted) "add
> S1G short beacon support" patch.

OK, fair enough, was just wondering :)

johannes

2020-09-18 17:55:17

by Thomas Pedersen

[permalink] [raw]
Subject: Re: [PATCH v3 04/22] nl80211: correctly validate S1G beacon head

On 2020-09-18 03:56, Johannes Berg wrote:
> On Tue, 2020-09-08 at 12:03 -0700, Thomas Pedersen wrote:
>> The S1G beacon has a different header size than regular
>> beacons, so adjust the beacon head validator.
>
> I've applied this already and will keep it, but you later add short
> beacons - don't they need further adjustments here too?

Yes, but I was planning on doing that in the (yet to be submitted) "add
S1G
short beacon support" patch.

--
thomas