diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2022-10-05 21:24:10 +0200 |
|---|---|---|
| committer | Lee Jones <joneslee@google.com> | 2022-11-02 08:10:16 +0000 |
| commit | 79651ab7fbad32e1f0f46e9b0d18b63b69c1c58e (patch) | |
| tree | 0690bfed02ca169a4dbbb9abecd2b96621679491 | |
| parent | 29886c4c8f6b0555effb8c50a4ff566167cab686 (diff) | |
| download | common-79651ab7fbad32e1f0f46e9b0d18b63b69c1c58e.tar.gz | |
UPSTREAM: wifi: mac80211: fix crash in beacon protection for P2P-device
commit b2d03cabe2b2e150ff5a381731ea0355459be09f upstream.
If beacon protection is active but the beacon cannot be
decrypted or is otherwise malformed, we call the cfg80211
API to report this to userspace, but that uses a netdev
pointer, which isn't present for P2P-Device. Fix this to
call it only conditionally to ensure cfg80211 won't crash
in the case of P2P-Device.
This fixes CVE-2022-42722.
Bug: 253642089
Bug: 256773215
Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 9eaf183af741 ("mac80211: Report beacon protection failures to user space")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ie3336b950136e26debbe835f97ad450d03f6baad
| -rw-r--r-- | net/mac80211/rx.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index d27c444a19ed..b6bcb34ec6bb 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1976,10 +1976,11 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS || mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS + - NUM_DEFAULT_BEACON_KEYS) { - cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, - skb->data, - skb->len); + NUM_DEFAULT_BEACON_KEYS) { + if (rx->sdata->dev) + cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, + skb->data, + skb->len); return RX_DROP_MONITOR; /* unexpected BIP keyidx */ } @@ -2127,7 +2128,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) /* either the frame has been decrypted or will be dropped */ status->flag |= RX_FLAG_DECRYPTED; - if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE)) + if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE && + rx->sdata->dev)) cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, skb->data, skb->len); |