From patchwork Mon Feb 14 16:29:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 12745792 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8672C433EF for ; Mon, 14 Feb 2022 16:29:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356364AbiBNQ3j (ORCPT ); Mon, 14 Feb 2022 11:29:39 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:37794 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356348AbiBNQ3i (ORCPT ); Mon, 14 Feb 2022 11:29:38 -0500 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:191:4433::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13AC960ABE for ; Mon, 14 Feb 2022 08:29:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: Message-Id:Date:Subject:Cc:To:From:Content-Type:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-To:Resent-Cc: Resent-Message-ID:In-Reply-To:References; bh=//ogqrnbTbG9qZuggmqzLjKcrKvsmNY+uCV+Rysxksw=; t=1644856170; x=1646065770; b=bDw6v+nElLqKKkPC27dX1fE+A+Wqqi98eR/dh9A06o8Dw5eJi5500ZRrw+xkclOvQ+lNdZeFNLD A72kZFC3Gq9tWaH+YsGBKaK4/q15PXWTTzwEoTVqcxzZO+/mY0x7Vx9hyJyjwq7l9e4fV+dFB5Pe9 5RMcTUqNlhyaBRAnnqgM1TGAMLgZsyn8Awog579dTORjz5/xa6eWJu0WPAo3WxQacLIibsUsMWE9r /RHhi4rszakfRigFkhxia1l9pIoPbvHoUzpkba4R89JH86IetX8h4W25CCgfM0KJR4bsCc/jjMxN+ f2vG9fIZiDSmYY9i5xxjfGURfcflrIVaJvzA==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) (envelope-from ) id 1nJeEB-0011jK-A6; Mon, 14 Feb 2022 17:29:27 +0100 From: Johannes Berg To: linux-wireless@vger.kernel.org Cc: Johannes Berg Subject: [PATCH v2 1/3] ieee80211: add helper to check HE capability element size Date: Mon, 14 Feb 2022 17:29:21 +0100 Message-Id: <20220214172920.750bee9eaf37.Ie18359bd38143b7dc949078f10752413e6d36854@changeid> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg This element has a very dynamic structure, create a small helper function to validate its size. We're currently checking it in mac80211 in a conversion function, but that's actually slightly buggy. Signed-off-by: Johannes Berg --- include/linux/ieee80211.h | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index a2940a853783..dfc84680af82 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -9,7 +9,7 @@ * Copyright (c) 2006, Michael Wu * Copyright (c) 2013 - 2014 Intel Mobile Communications GmbH * Copyright (c) 2016 - 2017 Intel Deutschland GmbH - * Copyright (c) 2018 - 2021 Intel Corporation + * Copyright (c) 2018 - 2022 Intel Corporation */ #ifndef LINUX_IEEE80211_H @@ -2338,6 +2338,29 @@ ieee80211_he_ppe_size(u8 ppe_thres_hdr, const u8 *phy_cap_info) return n; } +static inline bool ieee80211_he_capa_size_ok(const u8 *data, u8 len) +{ + const struct ieee80211_he_cap_elem *he_cap_ie_elem = (const void *)data; + u8 needed = sizeof(*he_cap_ie_elem); + + if (len < needed) + return false; + + needed += ieee80211_he_mcs_nss_size(he_cap_ie_elem); + if (len < needed) + return false; + + if (he_cap_ie_elem->phy_cap_info[6] & + IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) { + if (len < needed + 1) + return false; + needed += ieee80211_he_ppe_size(data[needed], + he_cap_ie_elem->phy_cap_info); + } + + return len >= needed; +} + /* HE Operation defines */ #define IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK 0x00000007 #define IEEE80211_HE_OPERATION_TWT_REQUIRED 0x00000008 From patchwork Mon Feb 14 16:29:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 12745791 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F3C9C433FE for ; Mon, 14 Feb 2022 16:29:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356359AbiBNQ3j (ORCPT ); Mon, 14 Feb 2022 11:29:39 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:37792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356356AbiBNQ3i (ORCPT ); Mon, 14 Feb 2022 11:29:38 -0500 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:191:4433::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13A5AC73 for ; Mon, 14 Feb 2022 08:29:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-To: Resent-Cc:Resent-Message-ID; bh=c5plFfXSJGJvXMuakN5YQNG7N6i55QikVaWkGFkmYFQ=; t=1644856170; x=1646065770; b=tJJ+GpIdwnFxIg4JLyT+3gp+UsOLasWmSG47MGRcJyt6OPL Ubh1/mnYskcW1clEUizwgeKkZAjnnj+YggPMGbNodthcy41XSgjQ2yEMhEhpkwQScRXYX760GJ90B UirzHessQYCSEq4JPTNnMNbQooVh6bLefmBQk0YQlac/aRvWNuq0YH/dkCfRffW8nZ2VpcpYKojwL U8GBJhMEsoG7SWw5ksPj1rilKwXANX9ma04B09+iAPdsDR87P2eAH2E4YpRSpe2udZQ+5rPDgr6Z0 VavyqHDdca8+1sWSQt6QUgcAfsGKQz/osKOIt0SxGOxiket+xOPgigsTE0Euoelw==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) (envelope-from ) id 1nJeEB-0011jK-Hw; Mon, 14 Feb 2022 17:29:27 +0100 From: Johannes Berg To: linux-wireless@vger.kernel.org Cc: Johannes Berg Subject: [PATCH v2 2/3] mac80211: parse only HE capability elements with valid size Date: Mon, 14 Feb 2022 17:29:22 +0100 Message-Id: <20220214172920.b5b06f264a61.I645ac1e2dc0ace223ef3e551cd5a71c88bd55e04@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220214172920.750bee9eaf37.Ie18359bd38143b7dc949078f10752413e6d36854@changeid> References: <20220214172920.750bee9eaf37.Ie18359bd38143b7dc949078f10752413e6d36854@changeid> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg The code validates the HE capability element size later, but slightly wrong, so use the new helper to do it right and only accept it if it has a good size. Signed-off-by: Johannes Berg --- net/mac80211/util.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index abc29df6834c..1a8e18794387 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -973,8 +973,10 @@ static void ieee80211_parse_extension_element(u32 *crc, } break; case WLAN_EID_EXT_HE_CAPABILITY: - elems->he_cap = data; - elems->he_cap_len = len; + if (ieee80211_he_capa_size_ok(data, len)) { + elems->he_cap = data; + elems->he_cap_len = len; + } break; case WLAN_EID_EXT_HE_OPERATION: if (len >= sizeof(*elems->he_operation) && From patchwork Mon Feb 14 16:29:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 12745793 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D061CC433F5 for ; Mon, 14 Feb 2022 16:29:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356361AbiBNQ3k (ORCPT ); Mon, 14 Feb 2022 11:29:40 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:37838 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356348AbiBNQ3j (ORCPT ); Mon, 14 Feb 2022 11:29:39 -0500 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:191:4433::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A74560D87 for ; Mon, 14 Feb 2022 08:29:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-To: Resent-Cc:Resent-Message-ID; bh=Nfp7QzOMlKwwb1wQFYR0FAEOQmH91J88KUhxDcXsJgE=; t=1644856171; x=1646065771; b=VWaxXg0p8ZebC+Zqui39bsM7iCw/2iaU4/y3bNSGkakzpSG lYU4xPljBz8wZ9Gq1FMYYOROqSl3u93vFozvxdfmYL9M95l2cDlT3KrvJN99n21PoaMQ+eIwHusRb vs6NfNm/JbHQ6vv6F3ohmx1E7EVti536YiGwYnOvXsDlABwWFzkUk7/LFmxAwqYph9YbfjkGzzAkW 1buueVawsxxSXKVKjl3YceVBjWUlMCAkikzuyQcMyPmkorXqEfUkfMer48AW7rbMMMhYKJpyGYAsP Fu0/Fzp4w8p9QktkkV1OuBKKn91ZQF+dD1nvPbNEZoBXCZbdmnuu/m5uJ62fWkXQ==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) (envelope-from ) id 1nJeEB-0011jK-Vh; Mon, 14 Feb 2022 17:29:28 +0100 From: Johannes Berg To: linux-wireless@vger.kernel.org Cc: Johannes Berg Subject: [PATCH v2 3/3] nl80211: accept only HE capability elements with valid size Date: Mon, 14 Feb 2022 17:29:23 +0100 Message-Id: <20220214172921.80b710d45cb7.Id57ce32f9538a40e36c620fabedbd2c73346ef56@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220214172920.750bee9eaf37.Ie18359bd38143b7dc949078f10752413e6d36854@changeid> References: <20220214172920.750bee9eaf37.Ie18359bd38143b7dc949078f10752413e6d36854@changeid> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg The kernel (driver code) should be able to assume that a station's HE capabilities are not badly sized, so reject them if they are. Signed-off-by: Johannes Berg --- net/wireless/nl80211.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 578bff9c378b..0bdd11abe815 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -285,6 +285,18 @@ static int validate_ie_attr(const struct nlattr *attr, return -EINVAL; } +static int validate_he_capa(const struct nlattr *attr, + struct netlink_ext_ack *extack) +{ + if (nla_len(attr) < NL80211_HE_MIN_CAPABILITY_LEN) + return -EINVAL; + + if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr))) + return -EINVAL; + + return 0; +} + /* policy for the attributes */ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR]; @@ -730,9 +742,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, [NL80211_ATTR_HE_CAPABILITY] = - NLA_POLICY_RANGE(NLA_BINARY, - NL80211_HE_MIN_CAPABILITY_LEN, - NL80211_HE_MAX_CAPABILITY_LEN), + NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa, + NL80211_HE_MAX_CAPABILITY_LEN), [NL80211_ATTR_FTM_RESPONDER] = NLA_POLICY_NESTED(nl80211_ftm_responder_policy), [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),