[2/9] wifi: mac80211: move action length check up

Message ID	20230619161906.e799254e923f.I0a1de5f6bbdc1b2ef5efaa0ac80c7c3f39415538@changeid
State	New
Headers	show Return-Path: <linux-wireless-owner@vger.kernel.org> From: gregory.greenman@intel.com To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg <johannes.berg@intel.com>, Gregory Greenman <gregory.greenman@intel.com> Subject: [PATCH 2/9] wifi: mac80211: move action length check up Date: Mon, 19 Jun 2023 16:26:46 +0300 Message-Id: <20230619161906.e799254e923f.I0a1de5f6bbdc1b2ef5efaa0ac80c7c3f39415538@changeid> In-Reply-To: <20230619132653.902084-1-gregory.greenman@intel.com> References: <20230619132653.902084-1-gregory.greenman@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	cfg80211/mac80211 patches from our internal tree 2023-06-19 \| expand [0/9] cfg80211/mac80211 patches from our internal tree 2023-06-19 [2/9] wifi: mac80211: move action length check up [3/9] wifi: mac80211: drop some unprotected action frames [4/9] wifi: mac80211: store BSS param change count from assoc response [5/9] wifi: mac80211: always hold sdata lock in chanctx assign/unassign [6/9] wifi: mac80211: avoid lockdep checking when removing deflink [7/9] wifi: mac80211: fix CRC calculation for extended elems [8/9] wifi: cfg80211: Retrieve PSD information from RNR AP information [9/9] wifi: nl80211/reg: add no-EHT regulatory flag

Message ID

20230619161906.e799254e923f.I0a1de5f6bbdc1b2ef5efaa0ac80c7c3f39415538@changeid

State

New

Headers

From: gregory.greenman@intel.com
To: johannes@sipsolutions.net
Cc: linux-wireless@vger.kernel.org,
        Johannes Berg <johannes.berg@intel.com>,
        Gregory Greenman <gregory.greenman@intel.com>
Subject: [PATCH 2/9] wifi: mac80211: move action length check up
Date: Mon, 19 Jun 2023 16:26:46 +0300
Message-Id: 
 <20230619161906.e799254e923f.I0a1de5f6bbdc1b2ef5efaa0ac80c7c3f39415538@changeid>
In-Reply-To: <20230619132653.902084-1-gregory.greenman@intel.com>
References: <20230619132653.902084-1-gregory.greenman@intel.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

cfg80211/mac80211 patches from our internal tree 2023-06-19 | expand

Commit Message

Greenman, Gregory June 19, 2023, 1:26 p.m. UTC

From: Johannes Berg <johannes.berg@intel.com>

We'd like to add more checks to the function here for
action frames, so move up the length check from the
action processing.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
---
 net/mac80211/rx.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index a2109d61487f..5c1d6c2674ef 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3355,6 +3355,11 @@  ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
 	if (!ieee80211_is_mgmt(mgmt->frame_control))
 		return RX_DROP_MONITOR;
 
+	/* drop too small action frames */
+	if (ieee80211_is_action(mgmt->frame_control) &&
+	    rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
+		return RX_DROP_UNUSABLE;
+
 	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
 	    ieee80211_is_beacon(mgmt->frame_control) &&
 	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
@@ -3444,10 +3449,6 @@  ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 	if (!ieee80211_is_action(mgmt->frame_control))
 		return RX_CONTINUE;
 
-	/* drop too small frames */
-	if (len < IEEE80211_MIN_ACTION_SIZE)
-		return RX_DROP_UNUSABLE;
-
 	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
 	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
 	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)

[2/9] wifi: mac80211: move action length check up

Commit Message

Patch