Unverified Commit 672caec3 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12406 fix CVE-2024-43841 

Merge Pull Request from: @ci-robot 
 
PR sync from: dinglongwei <dinglongwei1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/IT4DQ5IFLOCIRXOTOTCNUIXTJDI3ECNU/ 
fix CVE-2024-43841

En-Wei Wu (1):
  wifi: virt_wifi: avoid reporting connection success with wrong SSID

Johannes Berg (1):
  wifi: virt_wifi: don't use strlen() in const context


-- 
2.17.1
 
https://gitee.com/src-openeuler/kernel/issues/IAKQ2K 
 
Link:https://gitee.com/openeuler/kernel/pulls/12406

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 52e62ae6 51d56341

drivers/net/wireless/virt_wifi.c

+17 −3
Original line number Diff line number Diff line
@@ -136,6 +136,9 @@ static struct ieee80211_supported_band band_5ghz = { 
/* Assigned at module init. Guaranteed locally-administered and unicast. */

static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {};



#define VIRT_WIFI_SSID "VirtWifi"

#define VIRT_WIFI_SSID_LEN 8



static void virt_wifi_inform_bss(struct wiphy *wiphy)

{

	u64 tsf = div_u64(ktime_get_boottime_ns(), 1000);
@@ -146,8 +149,8 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy) 
		u8 ssid[8];

	} __packed ssid = {

		.tag = WLAN_EID_SSID,

		.len = 8,

		.ssid = "VirtWifi",

		.len = VIRT_WIFI_SSID_LEN,

		.ssid = VIRT_WIFI_SSID,

	};



	informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
@@ -213,6 +216,8 @@ struct virt_wifi_netdev_priv { 
	struct net_device *upperdev;

	u32 tx_packets;

	u32 tx_failed;

	u32 connect_requested_ssid_len;

	u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN];

	u8 connect_requested_bss[ETH_ALEN];

	bool is_up;

	bool is_connected;
@@ -229,6 +234,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev, 
	if (priv->being_deleted || !priv->is_up)

		return -EBUSY;



	if (!sme->ssid)

		return -EINVAL;



	priv->connect_requested_ssid_len = sme->ssid_len;

	memcpy(priv->connect_requested_ssid, sme->ssid, sme->ssid_len);



	could_schedule = schedule_delayed_work(&priv->connect, HZ * 2);

	if (!could_schedule)

		return -EBUSY;
@@ -252,12 +263,15 @@ static void virt_wifi_connect_complete(struct work_struct *work) 
		container_of(work, struct virt_wifi_netdev_priv, connect.work);

	u8 *requested_bss = priv->connect_requested_bss;

	bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid);

	bool right_ssid = priv->connect_requested_ssid_len == VIRT_WIFI_SSID_LEN &&

			  !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID,

				  priv->connect_requested_ssid_len);

	u16 status = WLAN_STATUS_SUCCESS;



	if (is_zero_ether_addr(requested_bss))

		requested_bss = NULL;



	if (!priv->is_up || (requested_bss && !right_addr))

	if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid)

		status = WLAN_STATUS_UNSPECIFIED_FAILURE;

	else

		priv->is_connected = true;