Unverified Commit 119aafed authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5340 CVE-2023-52593 

Merge Pull Request from: @ci-robot 
 
PR sync from: Chen Ridong <chenridong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/RWLXRRJGKE2BT5MY4BRZLWNMWTEU66QA/ 

Dmitry Antipov (1):
  wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I96GAG 
 
Link:https://gitee.com/openeuler/kernel/pulls/5340

 

Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents a36e9c1a 54a12a87

drivers/net/wireless/silabs/wfx/sta.c

+25 −17
Original line number Diff line number Diff line
@@ -354,29 +354,38 @@ static int wfx_upload_ap_templates(struct wfx_vif *wvif) 
	return 0;

}



static void wfx_set_mfp_ap(struct wfx_vif *wvif)

static int wfx_set_mfp_ap(struct wfx_vif *wvif)

{

	struct ieee80211_vif *vif = wvif_to_vif(wvif);

	struct sk_buff *skb = ieee80211_beacon_get(wvif->wdev->hw, vif, 0);

	const int ieoffset = offsetof(struct ieee80211_mgmt, u.beacon.variable);

	const u16 *ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,

						 skb->len - ieoffset);

	const int pairwise_cipher_suite_count_offset = 8 / sizeof(u16);

	const int pairwise_cipher_suite_size = 4 / sizeof(u16);

	const int akm_suite_size = 4 / sizeof(u16);

	const u16 *ptr;



	if (unlikely(!skb))

		return -ENOMEM;



	ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,

				      skb->len - ieoffset);

	if (unlikely(!ptr))

		return -EINVAL;



	if (ptr) {

	ptr += pairwise_cipher_suite_count_offset;

	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))

			return;

		return -EINVAL;



	ptr += 1 + pairwise_cipher_suite_size * *ptr;

	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))

			return;

		return -EINVAL;



	ptr += 1 + akm_suite_size * *ptr;

	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))

			return;

		return -EINVAL;



	wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6));

	}

	return 0;

}



int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -394,8 +403,7 @@ int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 
	ret = wfx_hif_start(wvif, &vif->bss_conf, wvif->channel);

	if (ret > 0)

		return -EIO;

	wfx_set_mfp_ap(wvif);

	return ret;

	return wfx_set_mfp_ap(wvif);

}



void wfx_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,