This is a note to let you know that I've just added the patch titled
nl80211: fix beacon head validation
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
nl80211-fix-beacon-head-validation.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 9a6847ba1747858ccac53c5aba3e25c54fbdf846 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@xxxxxxxxx>
Date: Thu, 8 Apr 2021 15:45:20 +0200
Subject: nl80211: fix beacon head validation
From: Johannes Berg <johannes.berg@xxxxxxxxx>
commit 9a6847ba1747858ccac53c5aba3e25c54fbdf846 upstream.
If the beacon head attribute (NL80211_ATTR_BEACON_HEAD)
is too short to even contain the frame control field,
we access uninitialized data beyond the buffer. Fix this
by checking the minimal required size first. We used to
do this until S1G support was added, where the fixed
data portion has a different size.
Reported-and-tested-by: syzbot+72b99dcf4607e8c770f3@xxxxxxxxxxxxxxxxxxxxxxxxx
Suggested-by: Eric Dumazet <eric.dumazet@xxxxxxxxx>
Fixes: 1d47f1198d58 ("nl80211: correctly validate S1G beacon head")
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Link: https://lore.kernel.org/r/20210408154518.d9b06d39b4ee.Iff908997b2a4067e8d456b3cb96cab9771d252b8@changeid
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/wireless/nl80211.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -209,9 +209,13 @@ static int validate_beacon_head(const st
unsigned int len = nla_len(attr);
const struct element *elem;
const struct ieee80211_mgmt *mgmt = (void *)data;
- bool s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
unsigned int fixedlen, hdrlen;
+ bool s1g_bcn;
+ if (len < offsetofend(typeof(*mgmt), frame_control))
+ goto err;
+
+ s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
if (s1g_bcn) {
fixedlen = offsetof(struct ieee80211_ext,
u.s1g_beacon.variable);
Patches currently in stable-queue which might be from johannes.berg@xxxxxxxxx are
queue-5.10/iwlwifi-pcie-properly-set-ltr-workarounds-on-22000-devices.patch
queue-5.10/mac80211-fix-txq-ac-confusion.patch
queue-5.10/nl80211-fix-beacon-head-validation.patch
queue-5.10/nl80211-fix-potential-leak-of-acl-params.patch
queue-5.10/cfg80211-check-s1g-beacon-compat-element-length.patch
queue-5.10/mac80211-fix-time-is-after-bug-in-mlme.patch
