tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wifi: cfg80211: correct S1G beacon length calculation

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2083488

[ Upstream commit 6873cc4416078202882691b424fcca5b5fb1a94d ]

The minimum header length calculation (equivalent to the start
of the elements) for the S1G long beacon erroneously required
only up to the start of u.s1g_beacon rather than the start of
u.s1g_beacon.variable. Fix that, and also shuffle the branches
around a bit to not assign useless values that are overwritten
later.

Reported-by: syzbot+0f3afa93b91202f21939@syzkaller.appspotmail.com
Fixes: 9eaffe5078 ("cfg80211: convert S1G beacon to scan results")
Link: https://patch.msgid.link/20240724132912.9662972db7c1.I8779675b5bbda4994cc66f876b6b87a2361c3c0b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[koichiroden: adjusted context due to missing upstream commits:
317bad4c3b61 ("wifi: cfg80211: remove cfg80211_inform_single_bss_frame_data()")
7e899c1d6f0d ("wifi: cfg80211: clean up cfg80211_inform_bss_frame_data()")]
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>
This commit is contained in:
Johannes Berg
2024-07-24 13:29:12 +02:00
committed by Mehmet Basaran
parent acba336e8e
commit 3749c7c7c7
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/wireless/scan.c
+8 -3
View File
@@ -3121,8 +3121,7 @@ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
struct ieee80211_ext *ext = NULL;
u8 *bssid, *variable;
u16 capability, beacon_int;
size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
u.probe_resp.variable);
size_t ielen, min_hdr_len;
int bss_type;
BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
@@ -3142,10 +3141,16 @@ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
ext = (void *) mgmt;
min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
min_hdr_len = offsetof(struct ieee80211_ext,
u.s1g_short_beacon.variable);
else
min_hdr_len = offsetof(struct ieee80211_mgmt,
u.probe_resp.variable);
} else {
/* same for beacons */
min_hdr_len = offsetof(struct ieee80211_mgmt,
u.probe_resp.variable);
}
if (WARN_ON(len < min_hdr_len))