git.openwrt.org Git - openwrt/openwrt.git/blob

   1 From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
   2 Date: Tue, 11 May 2021 20:02:44 +0200
   3 Subject: [PATCH] mac80211: properly handle A-MSDUs that start with an
   4  RFC 1042 header
   5
   6 Properly parse A-MSDUs whose first 6 bytes happen to equal a rfc1042
   7 header. This can occur in practice when the destination MAC address
   8 equals AA:AA:03:00:00:00. More importantly, this simplifies the next
   9 patch to mitigate A-MSDU injection attacks.
  10
  11 Cc: stable@vger.kernel.org
  12 Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
  13 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  14 ---
  15
  16 --- a/include/net/cfg80211.h
  17 +++ b/include/net/cfg80211.h
  18 @@ -5628,7 +5628,7 @@ unsigned int ieee80211_get_mesh_hdrlen(s
  19   */
  20  int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
  21                                   const u8 *addr, enum nl80211_iftype iftype,
  22 -                                 u8 data_offset);
  23 +                                 u8 data_offset, bool is_amsdu);
  24
  25  /**
  26   * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
  27 @@ -5640,7 +5640,7 @@ int ieee80211_data_to_8023_exthdr(struct
  28  static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
  29                                          enum nl80211_iftype iftype)
  30  {
  31 -       return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0);
  32 +       return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0, false);
  33  }
  34
  35  /**
  36 --- a/net/mac80211/rx.c
  37 +++ b/net/mac80211/rx.c
  38 @@ -2696,7 +2696,7 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
  39         if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
  40                                           rx->sdata->vif.addr,
  41                                           rx->sdata->vif.type,
  42 -                                         data_offset))
  43 +                                         data_offset, true))
  44                 return RX_DROP_UNUSABLE;
  45
  46         ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
  47 --- a/net/wireless/util.c
  48 +++ b/net/wireless/util.c
  49 @@ -541,7 +541,7 @@ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen)
  50
  51  int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
  52                                   const u8 *addr, enum nl80211_iftype iftype,
  53 -                                 u8 data_offset)
  54 +                                 u8 data_offset, bool is_amsdu)
  55  {
  56         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  57         struct {
  58 @@ -629,7 +629,7 @@ int ieee80211_data_to_8023_exthdr(struct
  59         skb_copy_bits(skb, hdrlen, &payload, sizeof(payload));
  60         tmp.h_proto = payload.proto;
  61
  62 -       if (likely((ether_addr_equal(payload.hdr, rfc1042_header) &&
  63 +       if (likely((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
  64                     tmp.h_proto != htons(ETH_P_AARP) &&
  65                     tmp.h_proto != htons(ETH_P_IPX)) ||
  66                    ether_addr_equal(payload.hdr, bridge_tunnel_header)))