wifi: cfg80211/mac80211: reject bad MBSSID elements
Johannes Berg authored
commit 8f033d2b upstream.

Per spec, the maximum value for the MaxBSSID ('n') indicator is 8,
and the minimum is 1 since a multiple BSSID set with just one BSSID
doesn't make sense (the # of BSSIDs is limited by 2^n).

Limit this in the parsing in both cfg80211 and mac80211, rejecting
any elements with an invalid value.

This fixes potentially bad shifts in the processing of these inside
the cfg80211_gen_new_bssid() function later.

I found this during the investigation of CVE-2022-41674 fixed by the
previous patch.

Fixes: 0b8fb823 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Fixes: 78ac51f8

 ("mac80211: support multi-bssid")
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
74abb195
Name Last commit Last update
Documentation ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
LICENSES LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers
arch Revert "powerpc/rtas: Implement reentrant rtas call"
block Revert "block: freeze the queue earlier in del_gendisk"
certs certs: make system keyring depend on built-in x509 parser
crypto KEYS: asymmetric: enforce SM2 signature use pkey algo
drivers random: use expired timer rather than wq for mixing fast pool
fs ceph: don't truncate file in atomic_open
include scsi: stex: Properly zero out the passthrough command structure
init arm64: fix rodata=full
io_uring io_uring: ensure that cached task references are always put on exit
ipc ipc: Free mq_sysctls if ipc namespace creation failed
kernel bpf: Fix resetting logic for unreferenced kptrs
lib Makefile.debug: re-enable debug info for .S files
mm damon/sysfs: fix possible memleak on damon_sysfs_add_target
net wifi: cfg80211/mac80211: reject bad MBSSID elements
samples sample: bpf: xdp_router_ipv4: Allow the kernel to send arp requests
scripts Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
security efi: Correct Macmini DMI match in uefi cert quirk
sound ALSA: hda/realtek: Add quirk for HP Zbook Firefly 14 G9 model
tools perf tests record: Fail the test if the 'errs' counter is not zero
usr Merge tag 'mm-nonmm-stable-2022-05-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
virt KVM: Unconditionally get a ref to /dev/kvm module when creating a VM
.clang-format clang-format: Fix space after for_each macros
.cocciconfig scripts: add Linux .cocciconfig for coccinelle
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README
Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.