X-Git-Url: http://git.openwrt.org/?p=openwrt%2Fopenwrt.git;a=blobdiff_plain;f=package%2Fkernel%2Fmac80211%2Fpatches%2Fsubsys%2F308-mac80211-fix-radiotap-header-generation.patch;fp=package%2Fkernel%2Fmac80211%2Fpatches%2Fsubsys%2F308-mac80211-fix-radiotap-header-generation.patch;h=0000000000000000000000000000000000000000;hp=a408c3d802b9862a00115a103940b5b5c35c352e;hb=3531a96df77badd489681766e29c919b6e017b2d;hpb=30b93672ec48d247fcd86b5bca283423db5250b9 diff --git a/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch b/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch deleted file mode 100644 index a408c3d802..0000000000 --- a/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch +++ /dev/null @@ -1,49 +0,0 @@ -From: Johannes Berg -Date: Tue, 9 Nov 2021 10:02:04 +0100 -Subject: [PATCH] mac80211: fix radiotap header generation - -In commit 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header -bitmap") we accidentally pointed the position to the wrong place, so -we overwrite a present bitmap, and thus cause all kinds of trouble. - -To see the issue, note that the previous code read: - - pos = (void *)(it_present + 1); - -The requirement now is that we need to calculate pos via it_optional, -to not trigger the compiler hardening checks, as: - - pos = (void *)&rthdr->it_optional[...]; - -Rewriting the original expression, we get (obviously, since that just -adds "+ x - x" terms): - - pos = (void *)(it_present + 1 + rthdr->it_optional - rthdr->it_optional) - -and moving the "+ rthdr->it_optional" outside to be used as an array: - - pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; - -The original is off by one, fix it. - -Cc: stable@vger.kernel.org -Fixes: 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header bitmap") -Reported-by: Sid Hayn -Signed-off-by: Johannes Berg -Tested-by: Sid Hayn -Reviewed-by: Kees Cook -Link: https://lore.kernel.org/r/20211109100203.c61007433ed6.I1dade57aba7de9c4f48d68249adbae62636fd98c@changeid -Signed-off-by: Johannes Berg ---- - ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct - * the compiler to think we have walked past the end of the - * struct member. - */ -- pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional]; -+ pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; - - /* the order of the following fields is important */ -