Commit acd3c92a authored by Johannes Berg's avatar Johannes Berg
Browse files

wifi: cfg80211: don't allow multi-BSSID in S1G 



In S1G beacon frames there shouldn't be multi-BSSID elements
since that's not supported, remove that to avoid a potential
integer underflow and/or misparsing the frames due to the
different length of the fixed part of the frame.

While at it, initialize non_tx_data so we don't send garbage
values to the user (even if it doesn't seem to matter now.)

Reported-and-tested-by: default avatarSönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 9eaffe50 ("cfg80211: convert S1G beacon to scan results")
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 9f16b5c8

net/wireless/scan.c

+6 −1
Original line number Diff line number Diff line
@@ -2527,10 +2527,15 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy, 
	const struct cfg80211_bss_ies *ies1, *ies2;

	size_t ielen = len - offsetof(struct ieee80211_mgmt,

				      u.probe_resp.variable);

	struct cfg80211_non_tx_bss non_tx_data;

	struct cfg80211_non_tx_bss non_tx_data = {};



	res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,

						    len, gfp);



	/* don't do any further MBSSID handling for S1G */

	if (ieee80211_is_s1g_beacon(mgmt->frame_control))

		return res;



	if (!res || !wiphy->support_mbssid ||

	    !cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen))

		return res;