Message ID | 20180831083130.15525-13-luca@coelho.fi (mailing list archive) |
---|---|
State | Changes Requested |
Delegated to: | Johannes Berg |
Headers | show |
Series | cfg80211/mac80211 patches from our internal tree 2018-08-31 | expand |
On Fri, 2018-08-31 at 11:31 +0300, Luca Coelho wrote: > > + cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); > + if (cap && cap[1] >= sizeof(*params->he_cap) + 1) > + params->he_cap = (void *)(cap + 3); I think this should validate that the element is actually well-formed before passing it to the driver. To do this, need to refactor the size checks from ieee80211_he_cap_ie_to_sta_he_cap(). johannes
On Mon, 2018-09-03 at 10:56 +0200, Johannes Berg wrote: > On Fri, 2018-08-31 at 11:31 +0300, Luca Coelho wrote: > > > > + cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, > > ies_len); > > + if (cap && cap[1] >= sizeof(*params->he_cap) + 1) > > + params->he_cap = (void *)(cap + 3); > > I think this should validate that the element is actually well-formed > before passing it to the driver. To do this, need to refactor the > size > checks from ieee80211_he_cap_ie_to_sta_he_cap(). We don't currently check any of the other IEs we use in this function. Do you mean that this is relevant only for HE? I can spin the size checks off from mac80211 so it can be reused here, but maybe that should be in a separate patch? -- Cheers, Luca.
On Tue, 2018-09-04 at 13:43 +0300, Luca Coelho wrote: > On Mon, 2018-09-03 at 10:56 +0200, Johannes Berg wrote: > > On Fri, 2018-08-31 at 11:31 +0300, Luca Coelho wrote: > > > > > > + cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, > > > ies_len); > > > + if (cap && cap[1] >= sizeof(*params->he_cap) + 1) > > > + params->he_cap = (void *)(cap + 3); > > > > I think this should validate that the element is actually well-formed > > before passing it to the driver. To do this, need to refactor the > > size > > checks from ieee80211_he_cap_ie_to_sta_he_cap(). > > We don't currently check any of the other IEs we use in this function. > Do you mean that this is relevant only for HE? We do check all the other IEs, e.g. cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); if (cap && cap[1] >= sizeof(*params->vht_cap)) params->vht_cap = (void *)(cap + 2); Only HE has the variable-size thing where this isn't sufficient for a proper size check. > I can spin the size checks off from mac80211 so it can be reused here, > but maybe that should be in a separate patch? Sure, make it a separate patch and let it be before this one? :) johannes
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 46c4cbf54903..0bdf293061fb 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -849,6 +849,7 @@ struct cfg80211_bitrate_mask { * @beacon_rate: bitrate to be used for beacons * @ht_cap: HT capabilities (or %NULL if HT isn't enabled) * @vht_cap: VHT capabilities (or %NULL if VHT isn't enabled) + * @he_cap: HE capabilities (or %NULL if HE isn't enabled) * @ht_required: stations must support HT * @vht_required: stations must support VHT */ @@ -874,6 +875,7 @@ struct cfg80211_ap_settings { const struct ieee80211_ht_cap *ht_cap; const struct ieee80211_vht_cap *vht_cap; + const struct ieee80211_he_cap_elem *he_cap; bool ht_required, vht_required; }; diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index f9e8efd534f3..dc108266b5f9 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -4095,6 +4095,9 @@ static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); if (cap && cap[1] >= sizeof(*params->vht_cap)) params->vht_cap = (void *)(cap + 2); + cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); + if (cap && cap[1] >= sizeof(*params->he_cap) + 1) + params->he_cap = (void *)(cap + 3); } static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,