ath9k_htc: properly set MAC address and BSSID mask

Commit Message

Mathy Vanhoef Nov. 27, 2013, 1:10 p.m. UTC

Hi Oleksij,

It appears something went wrong with tabs/spaces when sending the patch over mail. It should work this time.

--
From: "Mathy Vanhoef" <[e-mail]>

Pick the MAC address of the first virtual interface as the new hardware MAC
address. Set BSSID mask according to this MAC address. This fixes CVE-2013-4579.

Signed-off-by: Mathy Vanhoef <[e-mail]>
---



On 26/11/2013 21:44, Oleksij Rempel wrote:
> Hi Mathy,
> 
> thank you for your work!
> suddenly this patch do not apply on top of
>  git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
> 
> can you please update it.
> 
> 
> Am 26.11.2013 19:13, schrieb Mathy Vanhoef:
>> From: "Mathy Vanhoef" <[e-mail]>
>>
>> Pick the MAC address of the first virtual interface as the new hardware MAC
>> address. Set BSSID mask according to this MAC address. This fixes
>> CVE-2013-4579.
>>
>> Signed-off-by: Mathy Vanhoef <[e-mail]>
>> ---
>> diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
>> b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
>> index d441045..84359c3 100644
>> --- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
>> +++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
>> @@ -147,21 +147,26 @@ static void ath9k_htc_bssid_iter(void *data, u8
>> *mac, struct ieee80211_vif *vif)
>>      struct ath9k_vif_iter_data *iter_data = data;
>>      int i;
>>  
>> -    for (i = 0; i < ETH_ALEN; i++)
>> -        iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
>> +    if (iter_data->hw_macaddr != NULL) {
>> +        for (i = 0; i < ETH_ALEN; i++)
>> +            iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
>> +    } else {
>> +        iter_data->hw_macaddr = mac;
>> +    }
>>  }
>>  
>> -static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
>> +static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv,
>>                       struct ieee80211_vif *vif)
>>  {
>>      struct ath_common *common = ath9k_hw_common(priv->ah);
>>      struct ath9k_vif_iter_data iter_data;
>>  
>>      /*
>> -     * Use the hardware MAC address as reference, the hardware uses it
>> -     * together with the BSSID mask when matching addresses.
>> +     * Pick the MAC address of the first interface as the new hardware
>> +     * MAC address. The hardware will use it together with the BSSID mask
>> +     * when matching addresses.
>>       */
>> -    iter_data.hw_macaddr = common->macaddr;
>> +    iter_data.hw_macaddr = NULL;
>>      memset(&iter_data.mask, 0xff, ETH_ALEN);
>>  
>>      if (vif)
>> @@ -173,6 +178,10 @@ static void ath9k_htc_set_bssid_mask(struct
>> ath9k_htc_priv *priv,
>>          ath9k_htc_bssid_iter, &iter_data);
>>  
>>      memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
>> +
>> +    if (iter_data.hw_macaddr)
>> +        memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
>> +
>>      ath_hw_setbssidmask(common);
>>  }
>>  
>> @@ -1083,7 +1092,7 @@ static int ath9k_htc_add_interface(struct
>> ieee80211_hw *hw,
>>          goto out;
>>      }
>>  
>> -    ath9k_htc_set_bssid_mask(priv, vif);
>> +    ath9k_htc_set_mac_bssid_mask(priv, vif);
>>  
>>      priv->vif_slot |= (1 << avp->index);
>>      priv->nvifs++;
>> @@ -1148,7 +1157,7 @@ static void ath9k_htc_remove_interface(struct
>> ieee80211_hw *hw,
>>  
>>      ath9k_htc_set_opmode(priv);
>>  
>> -    ath9k_htc_set_bssid_mask(priv, vif);
>> +    ath9k_htc_set_mac_bssid_mask(priv, vif);
>>  
>>      /*
>>       * Stop ANI only if there are no associated station interfaces.
>> diff --git a/drivers/net/wireless/ath/ath9k/main.c
>> b/drivers/net/wireless/ath/ath9k/main.c
>> index b6aad69..99ab0aa 100644
>> --- a/drivers/net/wireless/ath/ath9k/main.c
>> +++ b/drivers/net/wireless/ath/ath9k/main.c
>> @@ -885,8 +885,9 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
>>      struct ath_common *common = ath9k_hw_common(ah);
>>  
>>      /*
>> -     * Use the hardware MAC address as reference, the hardware uses it
>> -     * together with the BSSID mask when matching addresses.
>> +     * Pick the MAC address of the first interface as the new hardware
>> +     * MAC address. The hardware will use it together with the BSSID mask
>> +     * when matching addresses.
>>       */
>>      memset(iter_data, 0, sizeof(*iter_data));
>>      memset(&iter_data->mask, 0xff, ETH_ALEN);
>>
>>
>> Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm
>> -- 
>> To unsubscribe from this list: send the line "unsubscribe
>> linux-wireless" in
>> the body of a message to [e-mail]
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> 


Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Pau Koning Nov. 27, 2013, 1:58 p.m. UTC | #1

On Wed, Nov 27, 2013 at 2:10 PM, Mathy Vanhoef
<[e-mail]> wrote:
> Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm

Sorry, but the patch cannot be accepted when the disclaimer forbids it.
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index d441045..84359c3 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -147,21 +147,26 @@  static void ath9k_htc_bssid_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
 	struct ath9k_vif_iter_data *iter_data = data;
 	int i;
 
-	for (i = 0; i < ETH_ALEN; i++)
-		iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+	if (iter_data->hw_macaddr != NULL) {
+		for (i = 0; i < ETH_ALEN; i++)
+			iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+	} else {
+		iter_data->hw_macaddr = mac;
+	}
 }
 
-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
+static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv,
 				     struct ieee80211_vif *vif)
 {
 	struct ath_common *common = ath9k_hw_common(priv->ah);
 	struct ath9k_vif_iter_data iter_data;
 
 	/*
-	 * Use the hardware MAC address as reference, the hardware uses it
-	 * together with the BSSID mask when matching addresses.
+	 * Pick the MAC address of the first interface as the new hardware
+	 * MAC address. The hardware will use it together with the BSSID mask
+	 * when matching addresses.
 	 */
-	iter_data.hw_macaddr = common->macaddr;
+	iter_data.hw_macaddr = NULL;
 	memset(&iter_data.mask, 0xff, ETH_ALEN);
 
 	if (vif)
@@ -173,6 +178,10 @@  static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
 		ath9k_htc_bssid_iter, &iter_data);
 
 	memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
+
+	if (iter_data.hw_macaddr)
+		memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
+
 	ath_hw_setbssidmask(common);
 }
 
@@ -1083,7 +1092,7 @@  static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
 		goto out;
 	}
 
-	ath9k_htc_set_bssid_mask(priv, vif);
+	ath9k_htc_set_mac_bssid_mask(priv, vif);
 
 	priv->vif_slot |= (1 << avp->index);
 	priv->nvifs++;
@@ -1148,7 +1157,7 @@  static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
 
 	ath9k_htc_set_opmode(priv);
 
-	ath9k_htc_set_bssid_mask(priv, vif);
+	ath9k_htc_set_mac_bssid_mask(priv, vif);
 
 	/*
 	 * Stop ANI only if there are no associated station interfaces.
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index b6aad69..99ab0aa 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -885,8 +885,9 @@  void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
 	struct ath_common *common = ath9k_hw_common(ah);
 
 	/*
-	 * Use the hardware MAC address as reference, the hardware uses it
-	 * together with the BSSID mask when matching addresses.
+	 * Pick the MAC address of the first interface as the new hardware
+	 * MAC address. The hardware will use it together with the BSSID mask
+	 * when matching addresses.
 	 */
 	memset(iter_data, 0, sizeof(*iter_data));
 	memset(&iter_data->mask, 0xff, ETH_ALEN);