From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65549C4360C for ; Thu, 10 Oct 2019 09:00:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 351C821920 for ; Thu, 10 Oct 2019 09:00:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570698005; bh=Z7qMlZaZcDZIhgD5kbXQoS87jFUa8k4Q4KdfQBxnahk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=UQHIH/4/ritF9a6f9L3X2uYWKKpuZ4EKfBZkhQyxh9XvZ6aZKL4LAsQKXlLt0ibyn p5XY4UK9RQhP+5DHMmk65D8jkrt9YrLDUWZikBleJkQKm4RU/t0fC/Wj6EfBENNwMv 3X9coyFRdAHRahYbcA6KXZYmDZ5mRnQAg4OtpP/k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389065AbfJJJAE (ORCPT ); Thu, 10 Oct 2019 05:00:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:48130 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387767AbfJJInT (ORCPT ); Thu, 10 Oct 2019 04:43:19 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AF2C92190F; Thu, 10 Oct 2019 08:43:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570696999; bh=Z7qMlZaZcDZIhgD5kbXQoS87jFUa8k4Q4KdfQBxnahk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FWO25hlcnd4xuBLRvFeU7HTJyFBl1AerxaOQ52ZEvKhdP8IGr12hYRuXQd2mLVDX0 pQ8FqmwogrufWhENNVSNrdarNXgKJWXpTzHOv7DjJclutmFLfD+j7lKldrVDPEn+Bs /IGTpofHaH7ia7M4/zIqJ7KFyd3IyFnk/q8r1ZAE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Berg Subject: [PATCH 5.3 086/148] cfg80211: validate SSID/MBSSID element ordering assumption Date: Thu, 10 Oct 2019 10:35:47 +0200 Message-Id: <20191010083616.576489163@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191010083609.660878383@linuxfoundation.org> References: <20191010083609.660878383@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Johannes Berg commit 242b0931c1918c56cd1dc5563fd250a3c39b996d upstream. The code copying the data assumes that the SSID element is before the MBSSID element, but since the data is untrusted from the AP, this cannot be guaranteed. Validate that this is indeed the case and ignore the MBSSID otherwise, to avoid having to deal with both cases for the copy of data that should be between them. Cc: stable@vger.kernel.org Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") Link: https://lore.kernel.org/r/1569009255-I1673911f5eae02964e21bdc11b2bf58e5e207e59@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/scan.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -1711,7 +1711,12 @@ cfg80211_update_notlisted_nontrans(struc return; new_ie_len -= trans_ssid[1]; mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen); - if (!mbssid) + /* + * It's not valid to have the MBSSID element before SSID + * ignore if that happens - the code below assumes it is + * after (while copying things inbetween). + */ + if (!mbssid || mbssid < trans_ssid) return; new_ie_len -= mbssid[1]; rcu_read_lock();