github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 00:53:34 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: nl80211: strict checking attributes for NL80211_CMD_SET_BSS

Browse Source 
Assure user-space only modifies attributes for NL80211_CMD_SET_BSS
that are supported by the driver. This stricter checking is only done
when user-space commits to it by including NL80211_ATTR_BSS_PARAM.

Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20250817190435.1495094-4-arend.vanspriel@broadcom.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Arend van Spriel 2025-08-17 21:04:34 +02:00 committed by Johannes Berg
parent 18abf7a05f
commit 4f652a390d
2 changed files with 49 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/uapi/linux/nl80211.h
View File

@ -2931,7 +2931,10 @@ enum nl80211_commands {
* @enum nl80211_s1g_short_beacon_attrs for the attribute definitions.
*
* @NL80211_ATTR_BSS_PARAM: nested attribute used with %NL80211_CMD_GET_WIPHY
* which indicates which BSS parameters can be modified.
* which indicates which BSS parameters can be modified. The attribute can
* also be used as flag attribute by user-space in %NL80211_CMD_SET_BSS to
* indicate that it wants strict checking on the BSS parameters to be
* modified.
*
* @NUM_NL80211_ATTR: total number of nl80211_attrs available
* @NL80211_ATTR_MAX: highest attribute number currently defined

52
net/wireless/nl80211.c
View File

@ -879,6 +879,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
[NL80211_ATTR_S1G_LONG_BEACON_PERIOD] = NLA_POLICY_MIN(NLA_U8, 2),
[NL80211_ATTR_S1G_SHORT_BEACON] =
NLA_POLICY_NESTED(nl80211_s1g_short_beacon),
[NL80211_ATTR_BSS_PARAM] = { .type = NLA_FLAG },
};
/* policy for the key attributes */
@ -9083,6 +9084,8 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
struct net_device *dev = info->user_ptr[1];
struct bss_parameters params;
u32 bss_param_support = rdev->wiphy.bss_param_support;
u32 changed = 0;
bool strict;
memset(&params, 0, sizeof(params));
params.link_id = nl80211_link_id_or_invalid(info->attrs);
@ -9095,26 +9098,54 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
params.p2p_ctwindow = -1;
params.p2p_opp_ps = -1;
if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
strict = nla_get_flag(info->attrs[NL80211_ATTR_BSS_PARAM]);
if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) {
if (strict && !(bss_param_support & WIPHY_BSS_PARAM_CTS_PROT))
return -EINVAL;
params.use_cts_prot =
nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
changed |= WIPHY_BSS_PARAM_CTS_PROT;
}
if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) {
if (strict &&
!(bss_param_support & WIPHY_BSS_PARAM_SHORT_PREAMBLE))
return -EINVAL;
params.use_short_preamble =
nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
changed |= WIPHY_BSS_PARAM_SHORT_PREAMBLE;
}
if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) {
if (strict &&
!(bss_param_support & WIPHY_BSS_PARAM_SHORT_SLOT_TIME))
return -EINVAL;
params.use_short_slot_time =
nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
changed |= WIPHY_BSS_PARAM_SHORT_SLOT_TIME;
}
if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
if (strict &&
!(bss_param_support & WIPHY_BSS_PARAM_BASIC_RATES))
return -EINVAL;
params.basic_rates =
nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
params.basic_rates_len =
nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
changed |= WIPHY_BSS_PARAM_BASIC_RATES;
}
if (info->attrs[NL80211_ATTR_AP_ISOLATE])
params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
if (info->attrs[NL80211_ATTR_AP_ISOLATE]) {
if (strict && !(bss_param_support & WIPHY_BSS_PARAM_AP_ISOLATE))
return -EINVAL;
params.ap_isolate =
!!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
changed |= WIPHY_BSS_PARAM_AP_ISOLATE;
}
if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) {
if (strict && !(bss_param_support & WIPHY_BSS_PARAM_HT_OPMODE))
return -EINVAL;
params.ht_opmode =
nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
changed |= WIPHY_BSS_PARAM_HT_OPMODE;
}
if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
@ -9124,6 +9155,7 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
if (params.p2p_ctwindow != 0 &&
!(bss_param_support & WIPHY_BSS_PARAM_P2P_CTWINDOW))
return -EINVAL;
changed |= WIPHY_BSS_PARAM_P2P_CTWINDOW;
}
if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
@ -9132,9 +9164,11 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
return -EINVAL;
tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
if (tmp && !(bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
return -EINVAL;
params.p2p_opp_ps = tmp;
if (params.p2p_opp_ps &&
!(bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
!(rdev->wiphy.bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
return -EINVAL;
}
@ -9145,6 +9179,10 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
return -EOPNOTSUPP;
changed &= rdev->wiphy.bss_param_support;
if (!changed)
return 0;
return rdev_change_bss(rdev, dev, &params);
}