From: Thomas Pedersen <thomas@adapt-ip.com>
To: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-wireless <linux-wireless@vger.kernel.org>,
Thomas Pedersen <thomas@adapt-ip.com>
Subject: [PATCH 04/22] nl80211: correctly validate S1G beacon head
Date: Thu, 27 Aug 2020 15:32:46 -0700 [thread overview]
Message-ID: <20200827223304.16155-5-thomas@adapt-ip.com> (raw)
In-Reply-To: <20200827223304.16155-1-thomas@adapt-ip.com>
The S1G beacon has a different header size than regular
beacons, so adjust the beacon head validator.
Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
---
net/wireless/nl80211.c | 16 +++++++++++++---
net/wireless/util.c | 5 +++++
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a57872708108..c5950d154d66 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -209,14 +209,24 @@ static int validate_beacon_head(const struct nlattr *attr,
unsigned int len = nla_len(attr);
const struct element *elem;
const struct ieee80211_mgmt *mgmt = (void *)data;
- unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
- u.beacon.variable);
+ bool s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
+ unsigned int fixedlen, hdrlen;
+
+ if (s1g_bcn) {
+ fixedlen = offsetof(struct ieee80211_ext,
+ u.s1g_beacon.variable);
+ hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
+ } else {
+ fixedlen = offsetof(struct ieee80211_mgmt,
+ u.beacon.variable);
+ hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
+ }
if (len < fixedlen)
goto err;
if (ieee80211_hdrlen(mgmt->frame_control) !=
- offsetof(struct ieee80211_mgmt, u.beacon))
+ hdrlen)
goto err;
data += fixedlen;
diff --git a/net/wireless/util.c b/net/wireless/util.c
index dfad1c0f57ad..383278c05a75 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -397,6 +397,11 @@ unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
{
unsigned int hdrlen = 24;
+ if (ieee80211_is_ext(fc)) {
+ hdrlen = 4;
+ goto out;
+ }
+
if (ieee80211_is_data(fc)) {
if (ieee80211_has_a4(fc))
hdrlen = 30;
--
2.20.1
next prev parent reply other threads:[~2020-08-27 22:33 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-27 22:32 [PATCH 00/22] add initial S1G support Thomas Pedersen
2020-08-27 22:32 ` [PATCH 01/22] nl80211: advertise supported channel width in S1G Thomas Pedersen
2020-08-27 22:32 ` [PATCH 02/22] cfg80211: regulatory: pass min. bandwidth to regulatory rule extractor Thomas Pedersen
2020-08-28 1:38 ` kernel test robot
2020-08-28 6:21 ` Thomas Pedersen
2020-08-27 22:32 ` [PATCH 03/22] cfg80211: regulatory: handle S1G channels Thomas Pedersen
2020-08-27 22:32 ` Thomas Pedersen [this message]
2020-08-27 22:32 ` [PATCH 05/22] nl80211: support setting " Thomas Pedersen
2020-08-27 22:32 ` [PATCH 06/22] {cfg,mac}80211: get correct default channel width for S1G Thomas Pedersen
2020-08-27 22:32 ` [PATCH 07/22] mac80211: s1g: choose scanning width based on frequency Thomas Pedersen
2020-08-27 22:32 ` [PATCH 08/22] nl80211: support S1G capabilities Thomas Pedersen
2020-08-27 22:32 ` [PATCH 09/22] mac80211: support S1G STA capabilities Thomas Pedersen
2020-08-27 22:32 ` [PATCH 10/22] cfg80211: convert S1G beacon to scan results Thomas Pedersen
2020-08-27 22:32 ` [PATCH 11/22] cfg80211: parse S1G Operation element for BSS channel Thomas Pedersen
2020-08-27 22:32 ` [PATCH 12/22] mac80211: convert S1G beacon to scan results Thomas Pedersen
2020-08-27 22:32 ` [PATCH 13/22] cfg80211: handle Association Response from S1G STA Thomas Pedersen
2020-08-27 22:32 ` [PATCH 14/22] mac80211: encode listen interval for S1G Thomas Pedersen
2020-08-27 22:32 ` [PATCH 15/22] mac80211: don't calculate duration " Thomas Pedersen
2020-08-27 22:32 ` [PATCH 16/22] mac80211: handle S1G low rates Thomas Pedersen
2020-08-27 22:32 ` [PATCH 17/22] mac80211: avoid rate init for S1G band Thomas Pedersen
2020-08-27 22:33 ` [PATCH 18/22] mac80211: receive and process S1G beacons Thomas Pedersen
2020-08-27 22:33 ` [PATCH 19/22] mac80211: support S1G association Thomas Pedersen
2020-08-27 22:33 ` [PATCH 20/22] nl80211: include frequency offset in survey info Thomas Pedersen
2020-08-27 22:33 ` [PATCH 21/22] mac80211_hwsim: indicate support for S1G Thomas Pedersen
2020-08-28 6:54 ` kernel test robot
2020-08-28 7:52 ` Kalle Valo
2020-08-31 16:42 ` Thomas Pedersen
2020-08-30 2:28 ` [mac80211_hwsim] dc5ef7078b: BUG:KASAN:stack-out-of-bounds_in__freq_reg_info kernel test robot
2020-08-27 22:33 ` [PATCH 22/22] mac80211_hwsim: fix TSF timestamp write to S1G beacon Thomas Pedersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200827223304.16155-5-thomas@adapt-ip.com \
--to=thomas@adapt-ip.com \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).