diff options
| author | Jouni Malinen <jouni@codeaurora.org> | 2018-12-05 12:55:54 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-12-13 09:16:22 +0100 |
| commit | d66c1b9280d146f8b2215224ca42535d8ab1fb39 (patch) | |
| tree | 5e4842275d765629733b04c86e8c356645365878 /net | |
| parent | 98206f3400334cbe9f4c3a5c453e68640f1ffce6 (diff) | |
cfg80211: Fix busy loop regression in ieee80211_ie_split_ric()
commit 312ca38ddda64bac6513ec68e0ac3789b4eb44dc upstream.
This function was modified to support the information element extension
case (WLAN_EID_EXTENSION) in a manner that would result in an infinite
loop when going through set of IEs that include WLAN_EID_RIC_DATA and
contain an IE that is in the after_ric array. The only place where this
can currently happen is in mac80211 ieee80211_send_assoc() where
ieee80211_ie_split_ric() is called with after_ric[].
This can be triggered by valid data from user space nl80211
association/connect request (i.e., requiring GENL_UNS_ADMIN_PERM). The
only known application having an option to include WLAN_EID_RIC_DATA in
these requests is wpa_supplicant and it had a bug that prevented this
specific contents from being used (and because of that, not triggering
this kernel bug in an automated test case ap_ft_ric) and now that this
bug is fixed, it has a workaround to avoid this kernel issue.
WLAN_EID_RIC_DATA is currently used only for testing purposes, so this
does not cause significant harm for production use cases.
Fixes: 2512b1b18d07 ("mac80211: extend ieee80211_ie_split to support EXTENSION")
Cc: stable@vger.kernel.org
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/util.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/wireless/util.c b/net/wireless/util.c index 959ed3acd240..aad1c8e858e5 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -1418,6 +1418,8 @@ size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen, ies[pos + ext], ext == 2)) pos = skip_ie(ies, ielen, pos); + else + break; } } else { pos = skip_ie(ies, ielen, pos); |