From patchwork Tue Jul 14 12:31:56 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bob Copeland X-Patchwork-Id: 6786901 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 6B2B4C05AD for ; Tue, 14 Jul 2015 12:32:24 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 77616206E7 for ; Tue, 14 Jul 2015 12:32:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A484D206F2 for ; Tue, 14 Jul 2015 12:32:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752589AbbGNMcR (ORCPT ); Tue, 14 Jul 2015 08:32:17 -0400 Received: from mail-ie0-f170.google.com ([209.85.223.170]:32843 "EHLO mail-ie0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752182AbbGNMcP (ORCPT ); Tue, 14 Jul 2015 08:32:15 -0400 Received: by ietj16 with SMTP id j16so10056358iet.0 for ; Tue, 14 Jul 2015 05:32:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=HZp3oQdyPaX9L9oYgG8Uq3pU4CrGec5PF6GB0Gqc6Mk=; b=hININuHTtO+HWJuJ/9VW65LWMpHAOJ9a0jBDXGOVj9Z6hDanX4VQ5JykykgmJd3FT9 azKtIKrjpYH2Bz8+LcDAIIkGpE+ZgJJ1Bf7vsI5D3khjo7hn4Pjr0XDueyx4sAkpTsuC hJv2dYkJRHMZIX+BeIQzxPs5UoNHZaiE/lLYSLZOy4tV6zBxqvv2fdm+HCWBxUbFAWm5 CrG0sCnTwPrxnonrrWFSYesY5VcFRHNOGszBQ1UijPMkfKAluHBpRUm5kb/8v2tLW1Jg SG+VO/L5DUeCd8EJhj695ef1o5y+jFfG3wGzKWB95yYYzVSao4qpnasDVedG51h3X23P dXuw== X-Gm-Message-State: ALoCoQk9Tk6YCoi4sb/8qC10IEJJ0BwWvSb4z8UtjCtzbMZQ+mK8P5aWsovgJIrQgdDu3UC5a7RI X-Received: by 10.50.6.51 with SMTP id x19mr19030445igx.68.1436877134808; Tue, 14 Jul 2015 05:32:14 -0700 (PDT) Received: from hash ([2001:470:1d:6db:230:48ff:fe9d:9c89]) by smtp.gmail.com with ESMTPSA id i66sm461657ioe.0.2015.07.14.05.32.12 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Jul 2015 05:32:13 -0700 (PDT) Received: from bob by hash with local (Exim 4.84) (envelope-from ) id 1ZEzNS-0004aE-Ej; Tue, 14 Jul 2015 08:32:02 -0400 From: Bob Copeland To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, devel@lists.open80211s.org, Bob Copeland Subject: [PATCH v3 2/5] mac80211: add missing length check for confirm frames Date: Tue, 14 Jul 2015 08:31:56 -0400 Message-Id: <1436877119-17577-3-git-send-email-me@bobcopeland.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1436877119-17577-1-git-send-email-me@bobcopeland.com> References: <1436877119-17577-1-git-send-email-me@bobcopeland.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-8.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Although mesh_rx_plink_frame() already checks that frames have enough bytes for the action code plus another two bytes for capability/reason code, it doesn't take into account that confirm frames also have an additional two-byte aid. As a result, a corrupt frame could cause a subsequent subtraction to wrap around to ill effect. Add another check for this case. Signed-off-by: Bob Copeland --- v3: newly introduced net/mac80211/mesh_plink.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c index 956384087e12..ac1029f28133 100644 --- a/net/mac80211/mesh_plink.c +++ b/net/mac80211/mesh_plink.c @@ -1123,6 +1123,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, WLAN_SP_MESH_PEERING_CONFIRM) { baseaddr += 4; baselen += 4; + + if (baselen > len) + return; } ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems); mesh_process_plink_frame(sdata, mgmt, &elems);