nl80211: correctly validate MU-MIMO groups (4954601f) · Commits · 戴 / test

Since groups 0 and 63 are invalid, we should check for those bits. Note that the 802.11 spec specifies the *bit* order, but the CPU doesn't care about bit order since it can't address bits, so it's always treating BIT(0) as the lowest bit within a byte. Reported-by:

Jan Fuchs <jan.fuchs@lancom.de> Signed-off-by:

Johannes Berg <johannes.berg@intel.com>

net/wireless/nl80211.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -2764,8 +2764,8 @@ static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
		nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);

		/* bits 0 and 63 are reserved and must be zero */
		if ((mumimo_groups[0] & BIT(7)) \|\|
		(mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(0)))
		if ((mumimo_groups[0] & BIT(0)) \|\|
		(mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
		return -EINVAL;

		params->vht_mumimo_groups = mumimo_groups;

Admin message