linux: Add upstream patches for CVE-2022-4{1674,2719-2722}

[people/pmueller/ipfire-2.x.git] / src / patches / linux / linux-5.15-wifi-security-patches-10.patch

diff --git a/src/patches/linux/linux-5.15-wifi-security-patches-10.patch b/src/patches/linux/linux-5.15-wifi-security-patches-10.patch
new file mode 100644 (file)
index 0000000..51986af
--- /dev/null
+++ b/src/patches/linux/linux-5.15-wifi-security-patches-10.patch
@@ -0,0 +1,98 @@
+From 21df3a583e8e03d8f74fa2eedbcd7a2b3f5cabc1 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 13 Oct 2022 20:15:57 +0200
+Subject: [PATCH] mac80211: move CRC into struct ieee802_11_elems
+
+commit c6e37ed498f958254b5459253199e816b6bfc52f upstream.
+
+We're currently returning this value, but to prepare for
+returning the allocated structure, move it into there.
+
+Link: https://lore.kernel.org/r/20210920154009.479b8ebf999d.If0d4ba75ee38998dc3eeae25058aa748efcb2fc9@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Cc: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/ieee80211_i.h |  9 +++++----
+ net/mac80211/mlme.c        |  9 +++++----
+ net/mac80211/util.c        | 10 +++++-----
+ 3 files changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 4bd55af184b2..5ea38ae65809 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1532,6 +1532,7 @@ struct ieee80211_csa_ie {
+ struct ieee802_11_elems {
+       const u8 *ie_start;
+       size_t total_len;
++      u32 crc;
+ 
+       /* pointers to IEs */
+       const struct ieee80211_tdls_lnkie *lnk_id;
+@@ -2218,10 +2219,10 @@ static inline void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata,
+       ieee80211_tx_skb_tid(sdata, skb, 7);
+ }
+ 
+-u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+-                             struct ieee802_11_elems *elems,
+-                             u64 filter, u32 crc, u8 *transmitter_bssid,
+-                             u8 *bss_bssid);
++void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
++                              struct ieee802_11_elems *elems,
++                              u64 filter, u32 crc, u8 *transmitter_bssid,
++                              u8 *bss_bssid);
+ static inline void ieee802_11_parse_elems(const u8 *start, size_t len,
+                                         bool action,
+                                         struct ieee802_11_elems *elems,
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 1548f532dc1a..4414e82e71d1 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4102,10 +4102,11 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+        */
+       if (!ieee80211_is_s1g_beacon(hdr->frame_control))
+               ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+-      ncrc = ieee802_11_parse_elems_crc(variable,
+-                                        len - baselen, false, &elems,
+-                                        care_about_ies, ncrc,
+-                                        mgmt->bssid, bssid);
++      ieee802_11_parse_elems_crc(variable,
++                                 len - baselen, false, &elems,
++                                 care_about_ies, ncrc,
++                                 mgmt->bssid, bssid);
++      ncrc = elems.crc;
+ 
+       if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
+           ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 00543ea9c6b5..ceb6894381e4 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1468,10 +1468,10 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
+       return found ? profile_len : 0;
+ }
+ 
+-u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+-                             struct ieee802_11_elems *elems,
+-                             u64 filter, u32 crc, u8 *transmitter_bssid,
+-                             u8 *bss_bssid)
++void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
++                              struct ieee802_11_elems *elems,
++                              u64 filter, u32 crc, u8 *transmitter_bssid,
++                              u8 *bss_bssid)
+ {
+       const struct element *non_inherit = NULL;
+       u8 *nontransmitted_profile;
+@@ -1523,7 +1523,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+ 
+       kfree(nontransmitted_profile);
+ 
+-      return crc;
++      elems->crc = crc;
+ }
+ 
+ void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
+-- 
+2.30.2
+