Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 31c24392 authored May 27, 2021 by Huashan Qu

mac80211: fix possible oob and null pointer dereferenced issues



Add check to avoid array supp_rates out of bound access in function
sta_apply_parameters() and also add skb null pointer check before
access.

Change-Id: Ieeb2868b10019b5748732e28688ede36ca72b0cc
Signed-off-by: Huashan Qu <hqu@codeaurora.org>

parent 0d4feea6

net/mac80211/cfg.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -1477,6 +1477,8 @@ static int sta_apply_parameters(struct ieee80211_local *local,
		}

		if (params->supported_rates && params->supported_rates_len) {
		if (sband->band >= NUM_NL80211_BANDS)
		return -EINVAL;
		ieee80211_parse_bitrates(&sdata->vif.bss_conf.chandef,
		sband, params->supported_rates,
		params->supported_rates_len,

net/mac80211/wpa.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -991,6 +991,8 @@ ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
		return TX_DROP;

		skb = skb_peek(&tx->skbs);
		if (!skb)
		return TX_DROP;

		info = IEEE80211_SKB_CB(skb);

		@@ -1136,6 +1138,8 @@ ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
		return TX_DROP;

		skb = skb_peek(&tx->skbs);
		if (!skb)
		return TX_DROP;

		info = IEEE80211_SKB_CB(skb);