Unverified Commit 9c467013 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8699 wifi: cfg80211: check A-MSDU format more carefully 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/OSOOETSYLEA3DKEUEQUHIOA2GPU6Q32J/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9QGJD 
 
Link:https://gitee.com/openeuler/kernel/pulls/8699

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 74cd1e5b 3adc05c4

net/wireless/util.c

+5 −2
Original line number Diff line number Diff line
@@ -632,24 +632,27 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, 
	struct sk_buff *frame = NULL;

	u16 ethertype;

	u8 *payload;

	int offset = 0, remaining;

	int offset = 0;

	struct ethhdr eth;

	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);

	bool reuse_skb = false;

	bool last = false;



	while (!last) {

		int remaining = skb->len - offset;

		unsigned int subframe_len;

		int len;

		u8 padding;



		if (sizeof(eth) > remaining)

			goto purge;



		skb_copy_bits(skb, offset, &eth, sizeof(eth));

		len = ntohs(eth.h_proto);

		subframe_len = sizeof(struct ethhdr) + len;

		padding = (4 - subframe_len) & 0x3;



		/* the last MSDU has no padding */

		remaining = skb->len - offset;

		if (subframe_len > remaining)

			goto purge;

		/* mitigate A-MSDU aggregation injection attacks */