[PATCH wireless v2 0/2] wifi: rtw89: fix IE length passed to cfg80211_find_ie()

[PATCH wireless v2 0/2] wifi: rtw89: fix IE length passed to cfg80211_find_ie()

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

Two callers of cfg80211_find_ie() in rtw89 pass skb->len as the IE
data length, but since ies points past the management frame header
and fixed fields, the correct length is skb->len minus the header
offset. This causes cfg80211_find_ie() to potentially read past the
IE data boundary.

Changes since v1:
  - Straightened the cfg80211_find_ie() call in wow.c to a single line
  - Removed unnecessary blank line in wow.c
  Both per Ping-Ke Shih review feedback.

Tristan Madani (2):
  wifi: rtw89: fix IE length passed to cfg80211_find_ie() in 6 GHz probe
  wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

 drivers/net/wireless/realtek/rtw89/core.c | 6 +++++-
 drivers/net/wireless/realtek/rtw89/wow.c  | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

--
2.47.3

[PATCH wireless v2 1/2] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in 6 GHz probe

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

rtw89_core_cancel_6ghz_probe_tx() computes a pointer to the IE area
from a beacon/probe response frame:

    ies = mgmt->u.beacon.variable;

but then passes skb->len as the IE data length to cfg80211_find_ie().
Since skb->len covers the entire frame including the 36-byte management
header and fixed fields, cfg80211_find_ie() may read up to 36 bytes
past the end of the actual IE data.

Fix by computing the correct IE data length as skb->len minus the
header offset, and validating the minimum frame length before parsing.

Fixes: c6aa9a9c4725 ("wifi: rtw89: add RNR support for 6 GHz scan")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/realtek/rtw89/core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 397ebbfcac09a..6e000cdbb0219 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -2571,6 +2571,7 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 	struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
 	struct rtw89_pktofld_info *info;
+	size_t hdr_len = offsetof(struct ieee80211_mgmt, u.beacon.variable);
 	const u8 *ies = mgmt->u.beacon.variable, *ssid_ie;
 	bool queue_work = false;
 
@@ -2582,7 +2583,10 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
 		return;
 	}
 
-	ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len);
+	if (skb->len < hdr_len)
+		return;
+
+	ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len - hdr_len);
 
 	list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
 		if (ether_addr_equal(info->bssid, mgmt->bssid)) {
-- 
2.47.3

[PATCH wireless v2 2/2] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

__rtw89_wow_parse_akm() computes a pointer to the IE area from an
association request frame:

    ies = mgmt->u.assoc_req.variable;

but then passes skb->len as the IE data length to cfg80211_find_ie().
Since skb->len covers the entire frame including the 28-byte management
header and fixed fields, cfg80211_find_ie() may read past the end of the
actual IE data.

Fix by computing the correct IE data length as skb->len minus the
header offset, and validating the minimum frame length before parsing.

Fixes: 480dd4dddfc5 ("wifi: rtw89: enter power save mode aggressively")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/realtek/rtw89/wow.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
index 2dfa24c54e7d7..178c59692b13f 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.c
+++ b/drivers/net/wireless/realtek/rtw89/wow.c
@@ -16,10 +16,14 @@ void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)
 {
 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 	struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
+	size_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);
 	const u8 *rsn, *ies = mgmt->u.assoc_req.variable;
 	struct rtw89_rsn_ie *rsn_ie;
 
-	rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len);
+	if (skb->len < hdr_len)
+		return;
+
+	rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len - hdr_len);
 	if (!rsn)
 		return;
 
-- 
2.47.3

RE: [PATCH wireless v2 1/2] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in 6 GHz probe

[Ping-Ke Shih]

Tristan Madani <tristmd@gmail.com> wrote:
> @@ -2582,7 +2583,10 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
>                 return;
>         }
> 
> -       ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len);
> +       if (skb->len < hdr_len)
> +               return;
> +
> +       ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len - hdr_len);
> 
>         list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
>                 if (ether_addr_equal(info->bssid, mgmt->bssid)) {

The use of cfg80211_find_ie() was removed by [1].
Please use https://github.com/pkshih/rtw.git as codebase.

[1] https://lore.kernel.org/all/20260909070004.35353-5-pkshih@realtek.com/

RE: [PATCH wireless v2 2/2] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

[Ping-Ke Shih]

Tristan Madani <tristmd@gmail.com> wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> __rtw89_wow_parse_akm() computes a pointer to the IE area from an
> association request frame:
> 
>     ies = mgmt->u.assoc_req.variable;
> 
> but then passes skb->len as the IE data length to cfg80211_find_ie().
> Since skb->len covers the entire frame including the 28-byte management
> header and fixed fields, cfg80211_find_ie() may read past the end of the
> actual IE data.
> 
> Fix by computing the correct IE data length as skb->len minus the
> header offset, and validating the minimum frame length before parsing.
> 
> Fixes: 480dd4dddfc5 ("wifi: rtw89: enter power save mode aggressively")

it should be

Fixes: 92790c4e50d2 ("wifi: rtw89: wow: parsing Auth Key Management from associate request")

> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Acked-by: Ping-Ke Shih <pkshih@realtek.com>

Re: [PATCH wireless v2 2/2] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

[Ping-Ke Shih]

Tristan Madani <tristmd@gmail.com> wrote:

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> __rtw89_wow_parse_akm() computes a pointer to the IE area from an
> association request frame:
> 
>     ies = mgmt->u.assoc_req.variable;
> 
> but then passes skb->len as the IE data length to cfg80211_find_ie().
> Since skb->len covers the entire frame including the 28-byte management
> header and fixed fields, cfg80211_find_ie() may read past the end of the
> actual IE data.
> 
> Fix by computing the correct IE data length as skb->len minus the
> header offset, and validating the minimum frame length before parsing.
> 
> Fixes: 480dd4dddfc5 ("wifi: rtw89: enter power save mode aggressively")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

6c17c57d45ef wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

---
https://github.com/pkshih/rtw.git