github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mac80211: Fix overread in PREP frame processing

Browse Source 
When the AF flag is enabled, hwmp_prep_frame_process() overreads orig_addr
by 2 bytes. Since this occurs within the socket buffer, it does not read
across memory boundaries and therefore poses no security risk; however, we
will fix it as a precaution.

In this fix, a new function mesh_path_parse_reply_frame() is established to
separate the implementation of frame format validation and the check for
unsupported features. This is intended to facilitate future work when
implementing the currently unsupported parts.

Assisted-by: Claude:Sonnet 4.6
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Link: https://patch.msgid.link/20260529230952.124754-5-masashi.honma@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Masashi Honma 2026-05-30 08:09:47 +09:00 committed by Johannes Berg
parent 8b40b1d24a
commit d158e54476
3 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
include/linux/ieee80211-mesh.h
View File

@ -387,4 +387,20 @@ static inline bool ieee80211_mesh_preq_size_ok(const u8 *pos, u8 elen)
return elen == needed;
}
/* IEEE Std 802.11-2016 9.4.2.114 PREP element */
static inline bool ieee80211_mesh_prep_size_ok(const u8 *pos, u8 elen)
{
u8 needed;
/* Check if the element contains flags */
needed = sizeof(struct ieee80211_mesh_hwmp_prep_top);
if (elen < needed)
return false;
needed += (ieee80211_mesh_preq_prep_ae_enabled(pos) ? ETH_ALEN : 0)
/* Target External Address */ +
sizeof(struct ieee80211_mesh_hwmp_prep_bottom);
return elen == needed;
}
#endif /* LINUX_IEEE80211_MESH_H */

4
net/mac80211/mesh_hwmp.c
View File

@ -947,8 +947,8 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
path_metric);
}
if (elems->prep) {
if (elems->prep_len != 31)
/* Right now we support no AE */
/* Right now we do not support AE (Address Extension) */
if (ieee80211_mesh_preq_prep_ae_enabled(elems->prep))
goto free;
path_metric = hwmp_route_info_get(sdata, mgmt, elems->prep,
MPATH_PREP);

9
net/mac80211/parse.c
View File

@ -572,8 +572,13 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
}
break;
case WLAN_EID_PREP:
elems->prep = pos;
elems->prep_len = elen;
if (ieee80211_mesh_prep_size_ok(pos, elen)) {
elems->prep = pos;
elems->prep_len = elen;
} else {
elem_parse_failed =
IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
}
break;
case WLAN_EID_PERR:
elems->perr = pos;