A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 21:22:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

wifi: cfg80211: avoid nontransmitted BSS list corruption

Browse source 
If a non-transmitted BSS shares enough information (both
SSID and BSSID!) with another non-transmitted BSS of a
different AP, then we can find and update it, and then
try to add it to the non-transmitted BSS list. We do a
search for it on the transmitted BSS, but if it's not
there (but belongs to another transmitted BSS), the list
gets corrupted.

Since this is an erroneous situation, simply fail the
list insertion in this case and free the non-transmitted
BSS.

This fixes CVE-2022-42721.

Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235b ("cfg80211: Parsing of Multiple BSSID information in scanning")
Link: https://lore.kernel.org/all/20221013175145.382242160@linuxfoundation.org/
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: bcca852027e5878aec911a347407ecc88d6fff7f
Git-repo: https://android.googlesource.com/kernel/common

Change-Id: Icb2106b5ac5ff5e3ecb50bd09440bce5560fbb05
Signed-off-by: Srikanth Marepalli <quic_srimarep@quicinc.com>
This commit is contained in:
Srikanth Marepalli 2022-11-02 20:33:04 +05:30 • committed by Gerrit - the friendly Code Review server
commit 060227f10d
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
net/wireless/scan.c
View file

@ -390,6 +390,14 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
rcu_read_unlock();
/* This is a bit weird - it's not on the list, but already on another
* one! The only way that could happen is if there's some BSSID/SSID
* shared by multiple APs in their multi-BSSID profiles, potentially
* with hidden SSID mixed in ... ignore it.
*/
if (!list_empty(&nontrans_bss->nontrans_list))
return -EINVAL;
/* add to the list */
list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
return 0;