| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20230828-ieee80211_tim_ie-v1-2-6d7a4bab70ef@quicinc.com>
Date: Mon, 28 Aug 2023 10:52:04 -0700
From: Jeff Johnson <quic_jjohnson@...cinc.com>
To: <kernel@...cinc.com>, Kalle Valo <kvalo@...nel.org>,
Toke Høiland-Jørgensen <toke@...e.dk>,
"Christian
Lamparter" <chunkeey@...glemail.com>,
Stanislaw Gruszka <stf_xl@...pl>,
"Helmut Schaa" <helmut.schaa@...glemail.com>,
Ping-Ke Shih
<pkshih@...ltek.com>,
Johannes Berg <johannes@...solutions.net>,
"David S.
Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>, Jakub
Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>
CC: <linux-wireless@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
<netdev@...r.kernel.org>, Jeff Johnson <quic_jjohnson@...cinc.com>
Subject: [PATCH 2/2] mac80211: Use flexible array in struct
ieee80211_tim_ie
Currently struct ieee80211_tim_ie defines:
u8 virtual_map[1];
Per the guidance in [1] change this to be a flexible array.
As a result of this change, adjust all related struct size tests to
account for the fact that the sizeof(struct ieee80211_tim_ie) no
accounts for the minimum size of the virtual_map.
[1] https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays
Signed-off-by: Jeff Johnson <quic_jjohnson@...cinc.com>
---
drivers/net/wireless/ath/ath9k/recv.c | 2 +-
drivers/net/wireless/ath/carl9170/rx.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 2 +-
drivers/net/wireless/realtek/rtlwifi/ps.c | 2 +-
drivers/net/wireless/st/cw1200/txrx.c | 2 +-
include/linux/ieee80211.h | 4 ++--
net/mac80211/util.c | 2 +-
7 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 0c0624a3b40d..2a263a1b7fbf 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -520,7 +520,7 @@ static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
break;
if (id == WLAN_EID_TIM) {
- if (elen < sizeof(*tim))
+ if (elen <= sizeof(*tim))
break;
tim = (struct ieee80211_tim_ie *) pos;
if (tim->dtim_count != 0)
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 908c4c8b7f82..5bdbde8c98a3 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -542,7 +542,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
if (!tim)
return;
- if (tim[1] < sizeof(*tim_ie))
+ if (tim[1] <= sizeof(*tim_ie))
return;
tim_len = tim[1];
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
index 9a9cfd0ce402..f594835da7ce 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
@@ -669,7 +669,7 @@ static void rt2x00lib_rxdone_check_ps(struct rt2x00_dev *rt2x00dev,
if (!tim)
return;
- if (tim[1] < sizeof(*tim_ie))
+ if (tim[1] <= sizeof(*tim_ie))
return;
tim_len = tim[1];
diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
index 629c03271bde..ea4b055bc6d8 100644
--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
+++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
@@ -506,7 +506,7 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
if (!tim)
return;
- if (tim[1] < sizeof(*tim_ie))
+ if (tim[1] <= sizeof(*tim_ie))
return;
tim_len = tim[1];
diff --git a/drivers/net/wireless/st/cw1200/txrx.c b/drivers/net/wireless/st/cw1200/txrx.c
index e16e9ae90d20..c2a51cd79ab8 100644
--- a/drivers/net/wireless/st/cw1200/txrx.c
+++ b/drivers/net/wireless/st/cw1200/txrx.c
@@ -1166,7 +1166,7 @@ void cw1200_rx_cb(struct cw1200_common *priv,
size_t ies_len = skb->len - (ies - (u8 *)(skb->data));
tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies, ies_len);
- if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
+ if (tim_ie && tim_ie[1] > sizeof(struct ieee80211_tim_ie)) {
struct ieee80211_tim_ie *tim =
(struct ieee80211_tim_ie *)&tim_ie[2];
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index bd2f6e19c357..4cdc2eb98f16 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -961,7 +961,7 @@ struct ieee80211_tim_ie {
u8 dtim_period;
u8 bitmap_ctrl;
/* variable size: 1 - 251 bytes */
- u8 virtual_map[1];
+ u8 virtual_map[];
} __packed;
/**
@@ -4405,7 +4405,7 @@ static inline bool ieee80211_check_tim(const struct ieee80211_tim_ie *tim,
u8 mask;
u8 index, indexn1, indexn2;
- if (unlikely(!tim || tim_len < sizeof(*tim)))
+ if (unlikely(!tim || tim_len <= sizeof(*tim)))
return false;
aid &= 0x3fff;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8a6917cf63cf..0c23223bb030 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1123,7 +1123,7 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
elem_parse_failed = true;
break;
case WLAN_EID_TIM:
- if (elen >= sizeof(struct ieee80211_tim_ie)) {
+ if (elen > sizeof(struct ieee80211_tim_ie)) {
elems->tim = (void *)pos;
elems->tim_len = elen;
} else
--
2.25.1
Powered by blists - more mailing lists