cfg80211: fix BSS struct IE access races (9caf0364) · Commits · 戴 / test

drivers/net/wireless/libertas/cfg.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -298,6 +298,7 @@ static int lbs_add_common_rates_tlv(u8 tlv, struct cfg80211_bss bss)
		const u8 rates_eid, ext_rates_eid;
		int n = 0;

		rcu_read_lock();
		rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
		ext_rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES);

		@@ -325,6 +326,7 @@ static int lbs_add_common_rates_tlv(u8 tlv, struct cfg80211_bss bss)
		*tlv++ = 0x96;
		n = 4;
		}
		rcu_read_unlock();

		rate_tlv->header.len = cpu_to_le16(n);
		return sizeof(rate_tlv->header) + n;
		@@ -1140,11 +1142,13 @@ static int lbs_associate(struct lbs_private *priv,
		cmd->capability = cpu_to_le16(bss->capability);

		/* add SSID TLV */
		rcu_read_lock();
		ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
		if (ssid_eid)
		pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
		else
		lbs_deb_assoc("no SSID\n");
		rcu_read_unlock();

		/* add DS param TLV */
		if (bss->channel)
		@@ -1782,7 +1786,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
		struct cfg80211_ibss_params *params,
		struct cfg80211_bss *bss)
		{
		const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
		const u8 *rates_eid;
		struct cmd_ds_802_11_ad_hoc_join cmd;
		u8 preamble = RADIO_PREAMBLE_SHORT;
		int ret = 0;
		@@ -1841,6 +1845,8 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,

		/* set rates to the intersection of our rates and the rates in the
		bss */
		rcu_read_lock();
		rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
		if (!rates_eid) {
		lbs_add_rates(cmd.bss.rates);
		} else {
		@@ -1860,6 +1866,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
		}
		}
		}
		rcu_read_unlock();

		/* Only v8 and below support setting this */
		if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {

drivers/net/wireless/mwifiex/sta_ioctl.c

+26 −9

Original line number	Diff line number	Diff line
		@@ -158,12 +158,22 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
		struct cfg80211_bss *bss,
		struct mwifiex_bssdescriptor *bss_desc)
		{
		int ret;
		int ret, beacon_ie_len;
		u8 *beacon_ie;
		struct mwifiex_bss_priv bss_priv = (void )bss->priv;
		const struct cfg80211_bss_ies *ies;

		rcu_read_lock();
		ies = rcu_dereference(bss->ies);
		if (WARN_ON(!ies)) {
		/* should never happen */
		rcu_read_unlock();
		return -EINVAL;
		}
		beacon_ie = kmemdup(ies->data, ies->len, GFP_ATOMIC);
		beacon_ie_len = ies->len;
		rcu_read_unlock();

		beacon_ie = kmemdup(bss->information_elements, bss->len_beacon_ies,
		GFP_KERNEL);
		if (!beacon_ie) {
		dev_err(priv->adapter->dev, " failed to alloc beacon_ie\n");
		return -ENOMEM;
		@@ -172,7 +182,7 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
		memcpy(bss_desc->mac_address, bss->bssid, ETH_ALEN);
		bss_desc->rssi = bss->signal;
		bss_desc->beacon_buf = beacon_ie;
		bss_desc->beacon_buf_size = bss->len_beacon_ies;
		bss_desc->beacon_buf_size = beacon_ie_len;
		bss_desc->beacon_period = bss->beacon_interval;
		bss_desc->cap_info_bitmap = bss->capability;
		bss_desc->bss_band = bss_priv->band;
		@@ -198,18 +208,23 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
		static int mwifiex_process_country_ie(struct mwifiex_private *priv,
		struct cfg80211_bss *bss)
		{
		u8 *country_ie, country_ie_len;
		const u8 *country_ie;
		u8 country_ie_len;
		struct mwifiex_802_11d_domain_reg *domain_info =
		&priv->adapter->domain_reg;

		country_ie = (u8 *)ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);

		if (!country_ie)
		rcu_read_lock();
		country_ie = ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
		if (!country_ie) {
		rcu_read_unlock();
		return 0;
		}

		country_ie_len = country_ie[1];
		if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
		if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN) {
		rcu_read_unlock();
		return 0;
		}

		domain_info->country_code[0] = country_ie[2];
		domain_info->country_code[1] = country_ie[3];
		@@ -223,6 +238,8 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
		memcpy((u8 *)domain_info->triplet,
		&country_ie[2] + IEEE80211_COUNTRY_STRING_LEN, country_ie_len);

		rcu_read_unlock();

		if (mwifiex_send_cmd_async(priv, HostCmd_CMD_802_11D_DOMAIN_INFO,
		HostCmd_ACT_GEN_SET, 0, NULL)) {
		wiphy_err(priv->adapter->wiphy,

include/net/cfg80211.h

+27 −14

Original line number	Diff line number	Diff line
		@@ -1205,6 +1205,18 @@ enum cfg80211_signal_type {
		CFG80211_SIGNAL_TYPE_UNSPEC,
		};

		/**
		* struct cfg80211_bss_ie_data - BSS entry IE data
		* @rcu_head: internal use, for freeing
		* @len: length of the IEs
		* @data: IE data
		*/
		struct cfg80211_bss_ies {
		struct rcu_head rcu_head;
		int len;
		u8 data[];
		};

		/**
		* struct cfg80211_bss - BSS description
		*
		@@ -1216,36 +1228,34 @@ enum cfg80211_signal_type {
		* @tsf: timestamp of last received update
		* @beacon_interval: the beacon interval as from the frame
		* @capability: the capability field in host byte order
		* @information_elements: the information elements (Note that there
		* @ies: the information elements (Note that there
		* is no guarantee that these are well-formed!); this is a pointer to
		* either the beacon_ies or proberesp_ies depending on whether Probe
		* Response frame has been received
		* @len_information_elements: total length of the information elements
		* @beacon_ies: the information elements from the last Beacon frame
		* @len_beacon_ies: total length of the beacon_ies
		* @proberesp_ies: the information elements from the last Probe Response frame
		* @len_proberesp_ies: total length of the proberesp_ies
		* @signal: signal strength value (type depends on the wiphy's signal_type)
		* @free_priv: function pointer to free private data
		* @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
		*/
		struct cfg80211_bss {
		u64 tsf;

		struct ieee80211_channel *channel;

		u8 bssid[ETH_ALEN];
		u64 tsf;
		const struct cfg80211_bss_ies __rcu *ies;
		const struct cfg80211_bss_ies __rcu *beacon_ies;
		const struct cfg80211_bss_ies __rcu *proberesp_ies;

		void (free_priv)(struct cfg80211_bss bss);

		s32 signal;

		u16 beacon_interval;
		u16 capability;
		u8 *information_elements;
		size_t len_information_elements;
		u8 *beacon_ies;
		size_t len_beacon_ies;
		u8 *proberesp_ies;
		size_t len_proberesp_ies;

		s32 signal;
		u8 bssid[ETH_ALEN];

		void (free_priv)(struct cfg80211_bss bss);
		u8 priv[0] __attribute__((__aligned__(sizeof(void *))));
		};

		@@ -1253,6 +1263,9 @@ struct cfg80211_bss {
		* ieee80211_bss_get_ie - find IE with given ID
		* @bss: the bss to search
		* @ie: the IE ID
		*
		* Note that the return value is an RCU-protected pointer, so
		* rcu_read_lock() must be held when calling this function.
		* Returns %NULL if not found.
		*/
		const u8 ieee80211_bss_get_ie(struct cfg80211_bss bss, u8 ie);

net/mac80211/mlme.c

+49 −31

Original line number	Diff line number	Diff line
		@@ -1382,11 +1382,16 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
		sdata->u.mgd.flags \|= IEEE80211_STA_RESET_SIGNAL_AVE;

		if (sdata->vif.p2p) {
		const struct cfg80211_bss_ies *ies;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
		u8 noa[2];
		int ret;

		ret = cfg80211_get_p2p_attr(cbss->information_elements,
		cbss->len_information_elements,
		ret = cfg80211_get_p2p_attr(
		ies->data, ies->len,
		IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
		noa, sizeof(noa));
		if (ret >= 2) {
		@@ -1396,6 +1401,8 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
		sdata->u.mgd.p2p_noa_index = noa[0];
		}
		}
		rcu_read_unlock();
		}

		/* just to be sure */
		ieee80211_stop_poll(sdata);
		@@ -1659,6 +1666,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
		} else {
		int ssid_len;

		rcu_read_lock();
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
		if (WARN_ON_ONCE(ssid == NULL))
		ssid_len = 0;
		@@ -1668,6 +1676,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
		ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
		0, (u32) -1, true, false,
		ifmgd->associated->channel, false);
		rcu_read_unlock();
		}

		ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
		@@ -1763,6 +1772,7 @@ struct sk_buff ieee80211_ap_probereq_get(struct ieee80211_hw hw,
		else
		return NULL;

		rcu_read_lock();
		ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
		if (WARN_ON_ONCE(ssid == NULL))
		ssid_len = 0;
		@@ -1773,6 +1783,7 @@ struct sk_buff ieee80211_ap_probereq_get(struct ieee80211_hw hw,
		(u32) -1, cbss->channel,
		ssid + 2, ssid_len,
		NULL, 0, true);
		rcu_read_unlock();

		return skb;
		}
		@@ -2858,9 +2869,12 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
		auth_data->bss->bssid, auth_data->tries,
		IEEE80211_AUTH_MAX_TRIES);

		rcu_read_lock();
		ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
		if (!ssidie)
		if (!ssidie) {
		rcu_read_unlock();
		return -EINVAL;
		}
		/*
		* Direct probe is sent to broadcast address as some APs
		* will not answer to direct packet in unassociated state.
		@@ -2868,6 +2882,7 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
		ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
		NULL, 0, (u32) -1, true, false,
		auth_data->bss->channel, false);
		rcu_read_unlock();
		}

		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
		@@ -3404,9 +3419,7 @@ static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
		if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

		ht_cap_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY,
		cbss->information_elements,
		cbss->len_information_elements);
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		@@ -3419,9 +3432,7 @@ static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
		if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

		vht_cap_ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY,
		cbss->information_elements,
		cbss->len_information_elements);
		vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;
		@@ -3457,13 +3468,13 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
		IEEE80211_STA_DISABLE_80P80MHZ \|
		IEEE80211_STA_DISABLE_160MHZ);

		rcu_read_lock();

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
		sband->ht_cap.ht_supported) {
		const u8 *ht_oper_ie;

		ht_oper_ie = cfg80211_find_ie(WLAN_EID_HT_OPERATION,
		cbss->information_elements,
		cbss->len_information_elements);
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
		ht_oper = (void *)(ht_oper_ie + 2);
		}
		@@ -3472,9 +3483,8 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
		sband->vht_cap.vht_supported) {
		const u8 *vht_oper_ie;

		vht_oper_ie = cfg80211_find_ie(WLAN_EID_VHT_OPERATION,
		cbss->information_elements,
		cbss->len_information_elements);
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
		WLAN_EID_VHT_OPERATION);
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
		vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
		@@ -3494,6 +3504,8 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
		sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
		local->rx_chains);

		rcu_read_unlock();

		/* will change later if needed */
		sdata->smps_mode = IEEE80211_SMPS_OFF;

		@@ -3734,14 +3746,21 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
		const u8 ssidie, ht_ie;
		int i, err;

		ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
		if (!ssidie)
		return -EINVAL;

		assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
		if (!assoc_data)
		return -ENOMEM;

		rcu_read_lock();
		ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
		if (!ssidie) {
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
		}
		memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
		assoc_data->ssid_len = ssidie[1];
		rcu_read_unlock();

		mutex_lock(&ifmgd->mtx);

		if (ifmgd->associated)
		@@ -3836,12 +3855,14 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
		assoc_data->supp_rates = bss->supp_rates;
		assoc_data->supp_rates_len = bss->supp_rates_len;

		rcu_read_lock();
		ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
		if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
		((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
		else
		ifmgd->flags \|= IEEE80211_STA_DISABLE_HT;
		rcu_read_unlock();

		if (bss->wmm_used && bss->uapsd_supported &&
		(sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
		@@ -3852,9 +3873,6 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
		}

		memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
		assoc_data->ssid_len = ssidie[1];

		if (req->prev_bssid)
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);

net/wireless/core.h

+0 −2

Original line number	Diff line number	Diff line
		@@ -138,8 +138,6 @@ struct cfg80211_internal_bss {
		unsigned long ts;
		struct kref ref;
		atomic_t hold;
		bool beacon_ies_allocated;
		bool proberesp_ies_allocated;

		/* must be last because of priv member */
		struct cfg80211_bss pub;

Admin message