This is a note to let you know that I've just added the patch titled
wifi: cfg80211: ensure length byte is present before access
to the 6.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
wifi-cfg80211-ensure-length-byte-is-present-before-access.patch
and it can be found in the queue-6.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 567e14e39e8f8c6997a1378bc3be615afca86063 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@xxxxxxxxx>
Date: Thu, 29 Sep 2022 21:50:44 +0200
Subject: wifi: cfg80211: ensure length byte is present before access
From: Johannes Berg <johannes.berg@xxxxxxxxx>
commit 567e14e39e8f8c6997a1378bc3be615afca86063 upstream.
When iterating the elements here, ensure the length byte is
present before checking it to see if the entire element will
fit into the buffer.
Longer term, we should rewrite this code using the type-safe
element iteration macros that check all of this.
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Reported-by: Soenke Huster <shuster@xxxxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/wireless/scan.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -304,7 +304,8 @@ static size_t cfg80211_gen_new_ie(const
tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
- while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {
+ while (tmp_old + 2 - ie <= ielen &&
+ tmp_old + tmp_old[1] + 2 - ie <= ielen) {
if (tmp_old[0] == 0) {
tmp_old++;
continue;
@@ -364,7 +365,8 @@ static size_t cfg80211_gen_new_ie(const
* copied to new ie, skip ssid, capability, bssid-index ie
*/
tmp_new = sub_copy;
- while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
+ while (tmp_new + 2 - sub_copy <= subie_len &&
+ tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
tmp_new[0] == WLAN_EID_SSID)) {
memcpy(pos, tmp_new, tmp_new[1] + 2);
Patches currently in stable-queue which might be from johannes.berg@xxxxxxxxx are
queue-6.0/wifi-mac80211-fix-crash-in-beacon-protection-for-p2p-device.patch
queue-6.0/wifi-cfg80211-avoid-nontransmitted-bss-list-corruption.patch
queue-6.0/wifi-cfg80211-mac80211-reject-bad-mbssid-elements.patch
queue-6.0/wifi-mac80211-fix-mbssid-parsing-use-after-free.patch
queue-6.0/wifi-cfg80211-ensure-length-byte-is-present-before-access.patch
queue-6.0/wifi-mac80211_hwsim-avoid-mac80211-warning-on-bad-rate.patch
queue-6.0/wifi-cfg80211-update-hidden-bsses-to-avoid-warn_on.patch
queue-6.0/wifi-cfg80211-fix-bss-refcounting-bugs.patch
queue-6.0/wifi-cfg80211-fix-u8-overflow-in-cfg80211_update_notlisted_nontrans.patch
