Commit 6c87720d authored by En-Wei Wu's avatar En-Wei Wu Committed by dinglongwei
Browse files

wifi: virt_wifi: avoid reporting connection success with wrong SSID 

stable inclusion
from stable-v5.10.224
commit 05c4488a0e446c6ccde9f22b573950665e1cd414
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2K
CVE: CVE-2024-43841

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05c4488a0e446c6ccde9f22b573950665e1cd414



--------------------------------

[ Upstream commit b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7 ]

When user issues a connection with a different SSID than the one
virt_wifi has advertised, the __cfg80211_connect_result() will
trigger the warning: WARN_ON(bss_not_found).

The issue is because the connection code in virt_wifi does not
check the SSID from user space (it only checks the BSSID), and
virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS
even if the SSID is different from the one virt_wifi has advertised.
Eventually cfg80211 won't be able to find the cfg80211_bss and generate
the warning.

Fixed it by checking the SSID (from user space) in the connection code.

Fixes: c7cdba31 ("mac80211-next: rtnetlink wifi simulation device")
Reported-by: default avatar <syzbot+d6eb9cee2885ec06f5e3@syzkaller.appspotmail.com>
Signed-off-by: default avatarEn-Wei Wu <en-wei.wu@canonical.com>
Link: https://patch.msgid.link/20240705023756.10954-1-en-wei.wu@canonical.com


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatardinglongwei <dinglongwei1@huawei.com>
parent 52e62ae6

drivers/net/wireless/virt_wifi.c

+16 −3
Original line number Diff line number Diff line
@@ -136,6 +136,8 @@ static struct ieee80211_supported_band band_5ghz = { 
/* Assigned at module init. Guaranteed locally-administered and unicast. */

static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {};



#define VIRT_WIFI_SSID "VirtWifi"



static void virt_wifi_inform_bss(struct wiphy *wiphy)

{

	u64 tsf = div_u64(ktime_get_boottime_ns(), 1000);
@@ -146,8 +148,8 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy) 
		u8 ssid[8];

	} __packed ssid = {

		.tag = WLAN_EID_SSID,

		.len = 8,

		.ssid = "VirtWifi",

		.len = strlen(VIRT_WIFI_SSID),

		.ssid = VIRT_WIFI_SSID,

	};



	informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
@@ -213,6 +215,8 @@ struct virt_wifi_netdev_priv { 
	struct net_device *upperdev;

	u32 tx_packets;

	u32 tx_failed;

	u32 connect_requested_ssid_len;

	u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN];

	u8 connect_requested_bss[ETH_ALEN];

	bool is_up;

	bool is_connected;
@@ -229,6 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev, 
	if (priv->being_deleted || !priv->is_up)

		return -EBUSY;



	if (!sme->ssid)

		return -EINVAL;



	priv->connect_requested_ssid_len = sme->ssid_len;

	memcpy(priv->connect_requested_ssid, sme->ssid, sme->ssid_len);



	could_schedule = schedule_delayed_work(&priv->connect, HZ * 2);

	if (!could_schedule)

		return -EBUSY;
@@ -252,12 +262,15 @@ static void virt_wifi_connect_complete(struct work_struct *work) 
		container_of(work, struct virt_wifi_netdev_priv, connect.work);

	u8 *requested_bss = priv->connect_requested_bss;

	bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid);

	bool right_ssid = priv->connect_requested_ssid_len == strlen(VIRT_WIFI_SSID) &&

			  !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID,

				  priv->connect_requested_ssid_len);

	u16 status = WLAN_STATUS_SUCCESS;



	if (is_zero_ether_addr(requested_bss))

		requested_bss = NULL;



	if (!priv->is_up || (requested_bss && !right_addr))

	if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid)

		status = WLAN_STATUS_UNSPECIFIED_FAILURE;

	else

		priv->is_connected = true;