Received-SPF: pass (google.com: domain of linux-wireless+bounces-5521-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Content-Type: text/plain;
	charset=utf-8
Precedence: bulk
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\))
Subject: Re: [PATCH] wifi: mac80211: ensure beacon is non-S1G prior to
 extracting the beacon timestamp field
From: Richard Kinder <richard.kinder@gmail.com>
In-Reply-To: <3009b152cd9f95065860d2de6b7ff8ee5775e579.camel@sipsolutions.net>
Date: Fri, 29 Mar 2024 14:24:42 +1100
Cc: linux-wireless@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <2E32B9D8-F9BC-4ADE-A501-9B9E3D0E75FF@gmail.com>
References: <20240328005725.85355-1-richard.kinder@gmail.com>
 <3009b152cd9f95065860d2de6b7ff8ee5775e579.camel@sipsolutions.net>
To: Johannes Berg <johannes@sipsolutions.net>


> On 29 Mar 2024, at 5:28=E2=80=AFAM, Johannes Berg =
<johannes@sipsolutions.net> wrote:
>=20
> On Thu, 2024-03-28 at 11:57 +1100, Richard Kinder wrote:
>> Logic inside ieee80211_rx_mgmt_beacon accesses the
>> mgmt->u.beacon.timestamp field without first checking whether the =
beacon
>> received is non-S1G format.
>>=20
>> Fix the problem by checking the beacon is non-S1G format to avoid =
access
>> of the mgmt->u.beacon.timestamp field.
>=20
> Huh, how did that end up being a problem, since iwlmvm with older
> devices is the only driver using that flag, and it doesn't support =
S1G?
>=20
> It's still correct, but it shouldn't be a problem now?
>=20
> johannes

Hi Johannes,

Thanks for the quick reply, much appreciated.

The motivation behind the patch was that a similar pattern is shown in =
lines
6315-6316: the same flag is checked along with !ieee80211_is_s1g_beacon.

If it is guaranteed that an interface running at non-S1G frequencies =
cannot
receive an S1G formatted frame at this point in the receive path, then =
the check
for is_s1g_beacon can be removed. However, could a malicious actor form =
an
S1G formatted frame with appropriate MAC addresses and trigger this path =
on
the older iwlmvm devices?

Regards,
Richard=