openwrt/package/kernel/mac80211/patches/subsys/397-disable-mbssid.patch
Felix Fietkau fa9a932fdb mac80211: backport security fix and disable MBSSID support
Fixes: CVE-2022-41674
Fixes: CVE-2022-42719
Fixes: CVE-2022-42720
Fixes: CVE-2022-42721
Fixes: CVE-2022-42722
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-10-13 21:16:38 +02:00

45 lines
1.3 KiB
Diff

--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1406,6 +1406,7 @@ static size_t ieee802_11_find_bssid_prof
if (!bss_bssid || !transmitter_bssid)
return profile_len;
+ return 0;
for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
if (elem->datalen < 2)
continue;
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1982,6 +1982,7 @@ static const struct element
const struct element *next_mbssid;
const struct element *next_sub;
+ return NULL;
next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
mbssid_end,
ielen - (mbssid_end - ie));
@@ -2063,6 +2064,7 @@ static void cfg80211_parse_mbssid_data(s
u16 capability;
struct cfg80211_bss *bss;
+ return;
if (!non_tx_data)
return;
if (!cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
@@ -2221,6 +2223,7 @@ cfg80211_update_notlisted_nontrans(struc
const struct cfg80211_bss_ies *old;
u8 cpy_len;
+ return;
lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
ie = mgmt->u.probe_resp.variable;
@@ -2436,6 +2439,7 @@ cfg80211_inform_bss_frame_data(struct wi
res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
len, gfp);
+ return res;
if (!res || !wiphy->support_mbssid ||
!cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
return res;