This is the 5.4.219 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNNc8kACgkQONu9yGCS aT7UwhAAtu3hyRqAt7LNcfL4wY9dBldVg4b/1fBtNpVXgOgPL7gktTfaZ04xyRdS BVcH/a+69nFAz7bDFhCAYVdypIbGuLXH99UHcL30u81xULH3P1+LRLjFc69HUTUM qlvuOujMIWx2QPn1NJeWZCTr2NX+TQbLt6WZwpcIOt0cJFZR5+YVpo3eYQnHy4S2 h0HPWpGQTD/ZLMIWsrLDaM8AsZwaQ2IDc2cGTBn3+ql8AghFHLInQN7En1mo+2bg Yp3qFHP7k/r6o94QiqagOYRwAWBjNj48wiWTOiDD3zfWjZTtIN6ZfQ5GOzk1Os8x o05cvEnbI0rw4FdRTGWvcJdCC6nrblSE21bY9LjrERBZVY6rYBbQS0pzBAc+ZT5l tELtaX088oDd4sHx0hUp1l6m2YLdURpEEUn3+LUgioKrFi3HUJZixh3J4YRwyimU eN/t9HLGsbCS8w4wLk5BlMAQh7nFCYngtm3wM4nhCBYuL3091Ico/fY60oAeYzCu qEbo73fWce7mgoHisEGwDSYoqDR+EeOFBTbPRB9qX1tI16AS28Op4LLQ99HVxgeO /F3hB+iDy8Olq0Tw5taiqsbDyFBkoA5G+Su60J1ywqs/7Zm6nuZosnASyGx7wOSB Tc6n1JOEAY9wwjuKYCnJYZBRMj2JhGoCXnKKbowXMz3Nn/7adGs= =rQnQ -----END PGP SIGNATURE----- Merge 5.4.219 into android11-5.4-lts Changes in 5.4.219 Revert "fs: check FMODE_LSEEK to control internal pipe splicing" mac80211: mlme: find auth challenge directly wifi: mac80211: don't parse mbssid in assoc response wifi: mac80211: fix MBSSID parsing use-after-free Linux 5.4.219 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I23480812b6b0d4527bc81cbc07115eeabe07cc81
This commit is contained in:
Greg Kroah-Hartman
commit
f944347410
2
Makefile
2
Makefile
@ -1,7 +1,7 @@
|
||||
# SPDX-License-Identifier: GPL-2.0
|
||||
VERSION = 5
|
||||
PATCHLEVEL = 4
|
||||
SUBLEVEL = 218
|
||||
SUBLEVEL = 219
|
||||
EXTRAVERSION =
|
||||
NAME = Kleptomaniac Octopus
|
||||
|
||||
|
||||
@ -1460,7 +1460,6 @@ struct ieee802_11_elems {
|
||||
const u8 *supp_rates;
|
||||
const u8 *ds_params;
|
||||
const struct ieee80211_tim_ie *tim;
|
||||
const u8 *challenge;
|
||||
const u8 *rsn;
|
||||
const u8 *erp_info;
|
||||
const u8 *ext_supp_rates;
|
||||
@ -1507,7 +1506,6 @@ struct ieee802_11_elems {
|
||||
u8 ssid_len;
|
||||
u8 supp_rates_len;
|
||||
u8 tim_len;
|
||||
u8 challenge_len;
|
||||
u8 rsn_len;
|
||||
u8 ext_supp_rates_len;
|
||||
u8 wmm_info_len;
|
||||
@ -1521,6 +1519,8 @@ struct ieee802_11_elems {
|
||||
u8 country_elem_len;
|
||||
u8 bssid_index_len;
|
||||
|
||||
void *nontx_profile;
|
||||
|
||||
/* whether a parse error occurred while retrieving these elements */
|
||||
bool parse_error;
|
||||
};
|
||||
|
||||
@ -2832,14 +2832,14 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
|
||||
{
|
||||
struct ieee80211_local *local = sdata->local;
|
||||
struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
|
||||
const struct element *challenge;
|
||||
u8 *pos;
|
||||
struct ieee802_11_elems elems;
|
||||
u32 tx_flags = 0;
|
||||
|
||||
pos = mgmt->u.auth.variable;
|
||||
ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
|
||||
mgmt->bssid, auth_data->bss->bssid);
|
||||
if (!elems.challenge)
|
||||
challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
|
||||
len - (pos - (u8 *)mgmt));
|
||||
if (!challenge)
|
||||
return;
|
||||
auth_data->expected_transaction = 4;
|
||||
drv_mgd_prepare_tx(sdata->local, sdata, 0);
|
||||
@ -2847,7 +2847,8 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
|
||||
tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
|
||||
IEEE80211_TX_INTFL_MLME_CONN_TX;
|
||||
ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
|
||||
elems.challenge - 2, elems.challenge_len + 2,
|
||||
(void *)challenge,
|
||||
challenge->datalen + sizeof(*challenge),
|
||||
auth_data->bss->bssid, auth_data->bss->bssid,
|
||||
auth_data->key, auth_data->key_len,
|
||||
auth_data->key_idx, tx_flags);
|
||||
@ -3226,7 +3227,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
|
||||
|
||||
pos = mgmt->u.assoc_resp.variable;
|
||||
ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
|
||||
mgmt->bssid, assoc_data->bss->bssid);
|
||||
mgmt->bssid, NULL);
|
||||
|
||||
if (!elems.supp_rates) {
|
||||
sdata_info(sdata, "no SuppRates element in AssocResp\n");
|
||||
@ -3301,6 +3302,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
|
||||
sdata_info(sdata,
|
||||
"AP bug: VHT operation missing from AssocResp\n");
|
||||
}
|
||||
kfree(bss_elems.nontx_profile);
|
||||
}
|
||||
|
||||
/*
|
||||
@ -3578,7 +3580,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
|
||||
|
||||
pos = mgmt->u.assoc_resp.variable;
|
||||
ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
|
||||
mgmt->bssid, assoc_data->bss->bssid);
|
||||
mgmt->bssid, NULL);
|
||||
|
||||
if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
|
||||
elems.timeout_int &&
|
||||
@ -3885,6 +3887,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
|
||||
ifmgd->assoc_data->timeout = jiffies;
|
||||
ifmgd->assoc_data->timeout_started = true;
|
||||
run_again(sdata, ifmgd->assoc_data->timeout);
|
||||
kfree(elems.nontx_profile);
|
||||
return;
|
||||
}
|
||||
|
||||
@ -4052,7 +4055,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
|
||||
ieee80211_report_disconnect(sdata, deauth_buf,
|
||||
sizeof(deauth_buf), true,
|
||||
WLAN_REASON_DEAUTH_LEAVING);
|
||||
return;
|
||||
goto free;
|
||||
}
|
||||
|
||||
if (sta && elems.opmode_notif)
|
||||
@ -4067,6 +4070,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
|
||||
elems.cisco_dtpc_elem);
|
||||
|
||||
ieee80211_bss_info_change_notify(sdata, changed);
|
||||
free:
|
||||
kfree(elems.nontx_profile);
|
||||
}
|
||||
|
||||
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
|
||||
|
||||
@ -216,6 +216,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
|
||||
rx_status, beacon);
|
||||
}
|
||||
|
||||
kfree(elems.nontx_profile);
|
||||
|
||||
return bss;
|
||||
}
|
||||
|
||||
|
||||
@ -1006,10 +1006,6 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
|
||||
} else
|
||||
elem_parse_failed = true;
|
||||
break;
|
||||
case WLAN_EID_CHALLENGE:
|
||||
elems->challenge = pos;
|
||||
elems->challenge_len = elen;
|
||||
break;
|
||||
case WLAN_EID_VENDOR_SPECIFIC:
|
||||
if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
|
||||
pos[2] == 0xf2) {
|
||||
@ -1367,6 +1363,11 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
|
||||
cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
|
||||
nontransmitted_profile,
|
||||
nontransmitted_profile_len);
|
||||
if (!nontransmitted_profile_len) {
|
||||
nontransmitted_profile_len = 0;
|
||||
kfree(nontransmitted_profile);
|
||||
nontransmitted_profile = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
|
||||
@ -1396,7 +1397,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
|
||||
offsetofend(struct ieee80211_bssid_index, dtim_count))
|
||||
elems->dtim_count = elems->bssid_index->dtim_count;
|
||||
|
||||
kfree(nontransmitted_profile);
|
||||
elems->nontx_profile = nontransmitted_profile;
|
||||
|
||||
return crc;
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user