| Message ID | 20211109100203.c61007433ed6.I1dade57aba7de9c4f48d68249adbae62636fd98c@changeid (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Johannes Berg |
| Headers | show |
| Series | mac80211: fix radiotap header generation | expand |
Please add my tested-by as well. I tested with and without this patch on multiple chipsets and everything appears functional now. Thanks for the quick fix! Tested-by: Sid Hayn <sidhayn@gmail.com> On Tue, Nov 9, 2021 at 4:02 AM Johannes Berg <johannes@sipsolutions.net> wrote: > > From: Johannes Berg <johannes.berg@intel.com> > > In commit 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header > bitmap") we accidentally pointed the position to the wrong place, so > we overwrite a present bitmap, and thus cause all kinds of trouble. > > To see the issue, note that the previous code read: > > pos = (void *)(it_present + 1); > > The requirement now is that we need to calculate pos via it_optional, > to not trigger the compiler hardening checks, as: > > pos = (void *)&rthdr->it_optional[...]; > > Rewriting the original expression, we get (obviously, since that just > adds "+ x - x" terms): > > pos = (void *)(it_present + 1 + rthdr->it_optional - rthdr->it_optional) > > and moving the "+ rthdr->it_optional" outside to be used as an array: > > pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; > > The original is off by one, fix it. > > Cc: stable@vger.kernel.org > Fixes: 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header bitmap") > Reported-by: Sid Hayn <sidhayn@gmail.com> > Signed-off-by: Johannes Berg <johannes.berg@intel.com> > --- > net/mac80211/rx.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c > index fc5c608d02e2..3562730ea0f8 100644 > --- a/net/mac80211/rx.c > +++ b/net/mac80211/rx.c > @@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, > * the compiler to think we have walked past the end of the > * struct member. > */ > - pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional]; > + pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; > > /* the order of the following fields is important */ > > -- > 2.31.1 >
On Tue, Nov 09, 2021 at 10:02:04AM +0100, Johannes Berg wrote: > From: Johannes Berg <johannes.berg@intel.com> > > In commit 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header > bitmap") we accidentally pointed the position to the wrong place, so > we overwrite a present bitmap, and thus cause all kinds of trouble. > > To see the issue, note that the previous code read: > > pos = (void *)(it_present + 1); > > The requirement now is that we need to calculate pos via it_optional, > to not trigger the compiler hardening checks, as: > > pos = (void *)&rthdr->it_optional[...]; > > Rewriting the original expression, we get (obviously, since that just > adds "+ x - x" terms): > > pos = (void *)(it_present + 1 + rthdr->it_optional - rthdr->it_optional) > > and moving the "+ rthdr->it_optional" outside to be used as an array: > > pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; > > The original is off by one, fix it. > > Cc: stable@vger.kernel.org > Fixes: 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header bitmap") > Reported-by: Sid Hayn <sidhayn@gmail.com> > Signed-off-by: Johannes Berg <johannes.berg@intel.com> Argh! Thank you for the fix and sorry for the trouble the earlier patch created! Reviewed-by: Kees Cook <keescook@chromium.org> -Kees > --- > net/mac80211/rx.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c > index fc5c608d02e2..3562730ea0f8 100644 > --- a/net/mac80211/rx.c > +++ b/net/mac80211/rx.c > @@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, > * the compiler to think we have walked past the end of the > * struct member. > */ > - pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional]; > + pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; > > /* the order of the following fields is important */ > > -- > 2.31.1 >
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index fc5c608d02e2..3562730ea0f8 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, * the compiler to think we have walked past the end of the * struct member. */ - pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional]; + pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; /* the order of the following fields is important */