linux-kernel - Re: [PATCH 5.2 1/2] mwifiex: Don't abort on small, spec-compliant vendor IEs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 24 Jun 2019 13:23:17 +0000 (UTC)
From:   Kalle Valo <kvalo@...eaurora.org>
To:     Brian Norris <briannorris@...omium.org>
Cc:     Ganapathi Bhat <gbhat@...vell.com>,
        Nishant Sarmukadam <nishants@...vell.com>,
        Amitkumar Karwar <amitkarwar@...il.com>,
        Xinming Hu <huxinming820@...il.com>,
        <linux-kernel@...r.kernel.org>, linux-wireless@...r.kernel.org,
        Takashi Iwai <tiwai@...e.de>,
        Guenter Roeck <linux@...ck-us.net>,
        Brian Norris <briannorris@...omium.org>
Subject: Re: [PATCH 5.2 1/2] mwifiex: Don't abort on small,
 spec-compliant vendor IEs

Brian Norris <briannorris@...omium.org> wrote:

> Per the 802.11 specification, vendor IEs are (at minimum) only required
> to contain an OUI. A type field is also included in ieee80211.h (struct
> ieee80211_vendor_ie) but doesn't appear in the specification. The
> remaining fields (subtype, version) are a convention used in WMM
> headers.
> 
> Thus, we should not reject vendor-specific IEs that have only the
> minimum length (3 bytes) -- we should skip over them (since we only want
> to match longer IEs, that match either WMM or WPA formats). We can
> reject elements that don't have the minimum-required 3 byte OUI.
> 
> While we're at it, move the non-standard subtype and version fields into
> the WMM structs, to avoid this confusion in the future about generic
> "vendor header" attributes.
> 
> Fixes: 685c9b7750bf ("mwifiex: Abort at too short BSS descriptor element")
> Cc: Takashi Iwai <tiwai@...e.de>
> Signed-off-by: Brian Norris <briannorris@...omium.org>
> Reviewed-by: Takashi Iwai <tiwai@...e.de>

Patch applied to wireless-drivers.git, thanks.

63d7ef36103d mwifiex: Don't abort on small, spec-compliant vendor IEs

-- 
https://patchwork.kernel.org/patch/10996895/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches