lkml.org 
[lkml]   [2007]   [Oct]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 04/26] Fix ieee80211 handling of bogus hdrlength field
    2.6.22-stable review patch.  If anyone has any objections, please let us
    know.

    ------------------
    From: John W. Linville <linville@tuxdriver.com>

    changeset 04045f98e0457aba7d4e6736f37eed189c48a5f7 from mainline

    Reported by Chris Evans <scarybeasts@gmail.com>:

    > The summary is that an evil 80211 frame can crash out a victim's
    > machine. It only applies to drivers using the 80211 wireless code, and
    > only then to certain drivers (and even then depends on a card's
    > firmware not dropping a dubious packet). I must confess I'm not
    > keeping track of Linux wireless support, and the different protocol
    > stacks etc.
    >
    > Details are as follows:
    >
    > ieee80211_rx() does not explicitly check that "skb->len >= hdrlen".
    > There are other skb->len checks, but not enough to prevent a subtle
    > off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag
    > set.
    >
    > This leads to integer underflow and crash here:
    >
    > if (frag != 0)
    > flen -= hdrlen;
    >
    > (flen is subsequently used as a memcpy length parameter).

    How about this?

    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/ieee80211/ieee80211_rx.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/net/ieee80211/ieee80211_rx.c
    +++ b/net/ieee80211/ieee80211_rx.c
    @@ -366,6 +366,12 @@ int ieee80211_rx(struct ieee80211_device
    frag = WLAN_GET_SEQ_FRAG(sc);
    hdrlen = ieee80211_get_hdrlen(fc);

    + if (skb->len < hdrlen) {
    + printk(KERN_INFO "%s: invalid SKB length %d\n",
    + dev->name, skb->len);
    + goto rx_dropped;
    + }
    +
    /* Put this code here so that we avoid duplicating it in all
    * Rx paths. - Jean II */
    #ifdef CONFIG_WIRELESS_EXT
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-10-31 16:29    [W:0.021 / U:3.052 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site