From patchwork Thu Feb 10 19:16:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 542095 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4EFF7C433EF for ; Thu, 10 Feb 2022 19:16:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343825AbiBJTQ3 (ORCPT ); Thu, 10 Feb 2022 14:16:29 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:51068 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239426AbiBJTQ2 (ORCPT ); Thu, 10 Feb 2022 14:16:28 -0500 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:191:4433::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7DF2210BA for ; Thu, 10 Feb 2022 11:16:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-To: Resent-Cc:Resent-Message-ID; bh=//ogqrnbTbG9qZuggmqzLjKcrKvsmNY+uCV+Rysxksw=; t=1644520589; x=1645730189; b=hoJLoaODvn6YT/95svQyZHhNkaXb7tj3mWjZAAnxUDCwvdG +j1cu4lkO7JWzbPXnmv6YURQJfGuWqBmLsXrUzxhgt6pS6UAN1fVkAGVWU4wj9BWXYl5ohg+FP0dZ 6/pl33PJjRzpr8eewH8HjRBO2p6Yv4HJ7auIegz3/PXMzPXUbO9n8u1zQ8bx7AmLuPQYgen1tBxdn v/Z84zw4OmdvbTQtuAqyjoDtcoRTTJf/688ibzWh8pEaueKJmIta09R/IBy263yCPeLeU60Ff421e jBu7cSZJhjoz3dUqfM8qo+/wd4BfLoZyBEg665novCHQO6zhejGGXDqFJ5VPKAWw==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) (envelope-from ) id 1nIEva-00HBut-9L; Thu, 10 Feb 2022 20:16:26 +0100 From: Johannes Berg To: linux-wireless@vger.kernel.org Cc: Johannes Berg Subject: [PATCH 1/3] ieee80211: add helper to check HE capability element size Date: Thu, 10 Feb 2022 20:16:21 +0100 Message-Id: <20220210201537.51af5886d599.Ie18359bd38143b7dc949078f10752413e6d36854@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220210191623.187684-1-johannes@sipsolutions.net> References: <20220210191623.187684-1-johannes@sipsolutions.net> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg This element has a very dynamic structure, create a small helper function to validate its size. We're currently checking it in mac80211 in a conversion function, but that's actually slightly buggy. Signed-off-by: Johannes Berg --- include/linux/ieee80211.h | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index a2940a853783..dfc84680af82 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -9,7 +9,7 @@ * Copyright (c) 2006, Michael Wu * Copyright (c) 2013 - 2014 Intel Mobile Communications GmbH * Copyright (c) 2016 - 2017 Intel Deutschland GmbH - * Copyright (c) 2018 - 2021 Intel Corporation + * Copyright (c) 2018 - 2022 Intel Corporation */ #ifndef LINUX_IEEE80211_H @@ -2338,6 +2338,29 @@ ieee80211_he_ppe_size(u8 ppe_thres_hdr, const u8 *phy_cap_info) return n; } +static inline bool ieee80211_he_capa_size_ok(const u8 *data, u8 len) +{ + const struct ieee80211_he_cap_elem *he_cap_ie_elem = (const void *)data; + u8 needed = sizeof(*he_cap_ie_elem); + + if (len < needed) + return false; + + needed += ieee80211_he_mcs_nss_size(he_cap_ie_elem); + if (len < needed) + return false; + + if (he_cap_ie_elem->phy_cap_info[6] & + IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) { + if (len < needed + 1) + return false; + needed += ieee80211_he_ppe_size(data[needed], + he_cap_ie_elem->phy_cap_info); + } + + return len >= needed; +} + /* HE Operation defines */ #define IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK 0x00000007 #define IEEE80211_HE_OPERATION_TWT_REQUIRED 0x00000008