Patch "wifi: mac80211_hwsim: drop short frames" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    wifi: mac80211_hwsim: drop short frames

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-mac80211_hwsim-drop-short-frames.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 08333a2aec2785e083c8362f0715dcb4772f79de
Author: Johannes Berg <johannes.berg@xxxxxxxxx>
Date:   Tue Aug 15 21:28:01 2023 +0200

    wifi: mac80211_hwsim: drop short frames
    
    [ Upstream commit fba360a047d5eeeb9d4b7c3a9b1c8308980ce9a6 ]
    
    While technically some control frames like ACK are shorter and
    end after Address 1, such frames shouldn't be forwarded through
    wmediumd or similar userspace, so require the full 3-address
    header to avoid accessing invalid memory if shorter frames are
    passed in.
    
    Reported-by: syzbot+b2645b5bf1512b81fa22@xxxxxxxxxxxxxxxxxxxxxxxxx
    Reviewed-by: Jeff Johnson <quic_jjohnson@xxxxxxxxxxx>
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index da5c355405f68..db70cef854bc4 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -4906,14 +4906,15 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
 	frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
 	frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
 
+	if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
+	    frame_data_len > IEEE80211_MAX_DATA_LEN)
+		goto err;
+
 	/* Allocate new skb here */
 	skb = alloc_skb(frame_data_len, GFP_KERNEL);
 	if (skb == NULL)
 		goto err;
 
-	if (frame_data_len > IEEE80211_MAX_DATA_LEN)
-		goto err;
-
 	/* Copy the data */
 	skb_put_data(skb, frame_data, frame_data_len);
 



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux