aboutsummaryrefslogtreecommitdiffstats
path: root/package
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@nbd.name>2021-11-26 08:42:25 +0100
committerFelix Fietkau <nbd@nbd.name>2021-11-26 08:42:37 +0100
commitb92a9f607b9af049c8e91a961947b0b10ea253a0 (patch)
tree510a45ecac8dac1edbb0a6a7e9dc7e8c93c04134 /package
parent68189835ac81779f9cf21060dca0c54dcdb0c0a6 (diff)
downloadupstream-b92a9f607b9af049c8e91a961947b0b10ea253a0.tar.gz
upstream-b92a9f607b9af049c8e91a961947b0b10ea253a0.tar.bz2
upstream-b92a9f607b9af049c8e91a961947b0b10ea253a0.zip
mac80211: fix a regression in generating radiotap headers
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'package')
-rw-r--r--package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch49
1 files changed, 49 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch b/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch
new file mode 100644
index 0000000000..a408c3d802
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch
@@ -0,0 +1,49 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 9 Nov 2021 10:02:04 +0100
+Subject: [PATCH] mac80211: fix radiotap header generation
+
+In commit 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header
+bitmap") we accidentally pointed the position to the wrong place, so
+we overwrite a present bitmap, and thus cause all kinds of trouble.
+
+To see the issue, note that the previous code read:
+
+ pos = (void *)(it_present + 1);
+
+The requirement now is that we need to calculate pos via it_optional,
+to not trigger the compiler hardening checks, as:
+
+ pos = (void *)&rthdr->it_optional[...];
+
+Rewriting the original expression, we get (obviously, since that just
+adds "+ x - x" terms):
+
+ pos = (void *)(it_present + 1 + rthdr->it_optional - rthdr->it_optional)
+
+and moving the "+ rthdr->it_optional" outside to be used as an array:
+
+ pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
+
+The original is off by one, fix it.
+
+Cc: stable@vger.kernel.org
+Fixes: 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header bitmap")
+Reported-by: Sid Hayn <sidhayn@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Tested-by: Sid Hayn <sidhayn@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20211109100203.c61007433ed6.I1dade57aba7de9c4f48d68249adbae62636fd98c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct
+ * the compiler to think we have walked past the end of the
+ * struct member.
+ */
+- pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional];
++ pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
+
+ /* the order of the following fields is important */
+