diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2022-11-25 12:36:58 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-12-08 11:28:40 +0100 |
| commit | dc0853f8b502a7cea385335fb2625625d1a447cb (patch) | |
| tree | 822d371d51d39a09cb60a7e1ee78869d9cb9ddaa /net | |
| parent | 88a6fe3707888bd1893e9741157a7035c4159ab6 (diff) | |
| download | linux-dc0853f8b502a7cea385335fb2625625d1a447cb.tar.gz linux-dc0853f8b502a7cea385335fb2625625d1a447cb.tar.bz2 linux-dc0853f8b502a7cea385335fb2625625d1a447cb.zip | |
wifi: cfg80211: don't allow multi-BSSID in S1G
[ Upstream commit acd3c92acc7aaec50a94d0a7faf7ccd74e952493 ]
In S1G beacon frames there shouldn't be multi-BSSID elements
since that's not supported, remove that to avoid a potential
integer underflow and/or misparsing the frames due to the
different length of the fixed part of the frame.
While at it, initialize non_tx_data so we don't send garbage
values to the user (even if it doesn't seem to matter now.)
Reported-and-tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/scan.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 937ec4c2a3bf..ef31e401d791 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2477,10 +2477,15 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy, const struct cfg80211_bss_ies *ies1, *ies2; size_t ielen = len - offsetof(struct ieee80211_mgmt, u.probe_resp.variable); - struct cfg80211_non_tx_bss non_tx_data; + struct cfg80211_non_tx_bss non_tx_data = {}; res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt, len, gfp); + + /* don't do any further MBSSID handling for S1G */ + if (ieee80211_is_s1g_beacon(mgmt->frame_control)) + return res; + if (!res || !wiphy->support_mbssid || !cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) return res; |