linux-kernel - Re: [PATCH] wifi: ieee80211: Fix for fragmented action frames

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 29 Aug 2022 09:17:37 +0200
From:   Johannes Berg <johannes@...solutions.net>
To:     Gilad Itzkovitch <gilad.itzkovitch@...semicro.com>
Cc:     linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] wifi: ieee80211: Fix for fragmented action frames

Hi,

On Mon, 2022-08-29 at 15:43 +1200, Gilad Itzkovitch wrote:
> 
> > This doesn't make much sense to me - why would it be allowed or
> > necessary to call this function on a frame that wasn't yet defragmented?
> 
> That was partially our understanding. But, the fragmented action frame is
> being dropped by this function
> 

Well, this function doesn't drop anything :) It just answers a question
"is this a robust management frame", but if the question is nonsense
(calling it on a fragment other than the first) then the answer will
also be nonsense, right?

> as it is part of the provisioning DPP process
> (fragmented due to S1G low rates).

Right.

> Trying to avoid a big change here for this specific action category.

It's not really related to any specific category, is it?

> As defragmentation will occur later on in the process there should be a
> safe way to avoid dropping the frame beforehand.

Sure! But this isn't really a good way, nor would I argue it is safe ...

Perhaps ieee80211_rx_h_decrypt() needs to be more careful? I'm not even
sure where the frame really is being dropped.

Anyway, I really don't think this patch makes any sense, I think you
need to back up a bit and look at the higher layer(s) to see where and
why it's being dropped, and skip that if it's fragmented?

johannes