From patchwork Tue Aug 15 19:28:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 714016 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 173CDC001E0 for ; Tue, 15 Aug 2023 19:29:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239420AbjHOT2i (ORCPT ); Tue, 15 Aug 2023 15:28:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37322 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239651AbjHOT2L (ORCPT ); Tue, 15 Aug 2023 15:28:11 -0400 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:242:246e::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 084EC109 for ; Tue, 15 Aug 2023 12:28:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: Message-ID:Date:Subject:Cc:To:From:Content-Type:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-To:Resent-Cc: Resent-Message-ID:In-Reply-To:References; bh=Do8ZOGRRrbe3DCtS/ZMrOHk/znd2aQXYun6nNo/jn4k=; t=1692127690; x=1693337290; b=m3d/eZyhHyyF3OlTE+uDvrahl6dLq8ipgP2oW4uW9/XXsL7M1XGEPxYtXakM7FuWM4WNMrIe1ho B2fay6uP/tnyFQT/Q+Dz4CZUVLjLTCM8ya052VP7uzVD17UCew49MAFnuUd8TG8rV5nDPZO8h5quG LOzcvnOtu+KqoCWRZ1nTd+rwUYWDEUwkrcJ9yQWA1IxThIk0NCv1XHZc5Ao+yJPm9u32TX+Ah2YMl IpXc+qTfJjBEdCIwJ4C2I0jbNptRaE9zH6dPvASR8KUF5CWkEyce9Z3SxfW+hvhgs9X8dEvvypAka iPbojUVL/ivU2lnyJ/4x65T1tWqjRI8K9qiQ==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1qVzi2-009Dxk-2r; Tue, 15 Aug 2023 21:28:07 +0200 From: Johannes Berg To: linux-wireless@vger.kernel.org Cc: Jeff Johnson , Johannes Berg , syzbot+b2645b5bf1512b81fa22@syzkaller.appspotmail.com Subject: [PATCH v2] wifi: mac80211_hwsim: drop short frames Date: Tue, 15 Aug 2023 21:28:01 +0200 Message-ID: <20230815212800.d849938fdc9f.I1efbeef082c3f7094037882f213202d760848eb7@changeid> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address header to avoid accessing invalid memory if shorter frames are passed in. Reported-by: syzbot+b2645b5bf1512b81fa22@syzkaller.appspotmail.com Signed-off-by: Johannes Berg Reviewed-by: Jeff Johnson --- drivers/net/wireless/virtual/mac80211_hwsim.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c index f446fd0e8cd0..dd516cec4197 100644 --- a/drivers/net/wireless/virtual/mac80211_hwsim.c +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c @@ -5626,14 +5626,15 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2, frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]); frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]); + if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) || + frame_data_len > IEEE80211_MAX_DATA_LEN) + goto err; + /* Allocate new skb here */ skb = alloc_skb(frame_data_len, GFP_KERNEL); if (skb == NULL) goto err; - if (frame_data_len > IEEE80211_MAX_DATA_LEN) - goto err; - /* Copy the data */ skb_put_data(skb, frame_data, frame_data_len);