Commit 02426cf2 authored by Johannes Berg's avatar Johannes Berg Committed by Sasha Levin

mac80211: discard multicast and 4-addr A-MSDUs

[ Upstream commit ea720935 ]

In mac80211, multicast A-MSDUs are accepted in many cases that
they shouldn't be accepted in:
 * drop A-MSDUs with a multicast A1 (RA), as required by the
   spec in 9.11 (802.11-2012 version)
 * drop A-MSDUs with a 4-addr header, since the fourth address
   can't actually be useful for them; unless 4-address frame
   format is actually requested, even though the fourth address
   is still not useful in this case, but ignored

Accepting the first case, in particular, is very problematic
since it allows anyone else with possession of a GTK to send
unicast frames encapsulated in a multicast A-MSDU, even when
the AP has client isolation enabled.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent f065a553
...@@ -2179,16 +2179,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) ...@@ -2179,16 +2179,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
if (!(status->rx_flags & IEEE80211_RX_AMSDU)) if (!(status->rx_flags & IEEE80211_RX_AMSDU))
return RX_CONTINUE; return RX_CONTINUE;
if (ieee80211_has_a4(hdr->frame_control) && if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && switch (rx->sdata->vif.type) {
!rx->sdata->u.vlan.sta) case NL80211_IFTYPE_AP_VLAN:
return RX_DROP_UNUSABLE; if (!rx->sdata->u.vlan.sta)
return RX_DROP_UNUSABLE;
break;
case NL80211_IFTYPE_STATION:
if (!rx->sdata->u.mgd.use_4addr)
return RX_DROP_UNUSABLE;
break;
default:
return RX_DROP_UNUSABLE;
}
}
if (is_multicast_ether_addr(hdr->addr1) && if (is_multicast_ether_addr(hdr->addr1))
((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
rx->sdata->u.vlan.sta) ||
(rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
rx->sdata->u.mgd.use_4addr)))
return RX_DROP_UNUSABLE; return RX_DROP_UNUSABLE;
skb->dev = dev; skb->dev = dev;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment