wifi: mac80211: validate extension-frame layout before RX

Extension frames only have the extension header at the regular 802.11
header offset. The generic RX path can still reach helpers and interface
dispatch code that read regular header address fields before unsupported
extension subtypes are dropped.

mac80211 currently only handles S1G beacon extension frames. Drop other
extension subtypes before they can reach regular-header RX processing.
For S1G beacons, linearize the SKB with the management-frame path and
require the fixed S1G beacon header, including optional fixed fields
indicated by frame control, before generic RX dispatch.

Route S1G beacons through the station/default-link RX path without
regular-header station lookup. Avoid regular-header address reads in the
mac80211 RX paths that process S1G extension beacons, including
accept-frame, duplicate-detection, address-copy, and MLO
address-translation paths.

Also make ieee80211_get_bssid() length-safe before returning the S1G
source-address pointer.

Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260611161943.91069-5-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fb9a3574afe99d888cc706696f3ac3138550d61b..d9ea19be075dc686c4a34884340b37a716e07ce7 100644 (file)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1526,6 +1526,9 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
        if (status->flag & RX_FLAG_DUP_VALIDATED)
                return RX_CONTINUE;
 
+       if (ieee80211_is_ext(hdr->frame_control))
+               return RX_CONTINUE;
+
        /*
         * Drop duplicate 802.11 retransmissions
         * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
@@ -4510,12 +4513,16 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
        struct ieee80211_hdr *hdr = (void *)skb->data;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
        u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
-       bool multicast = is_multicast_ether_addr(hdr->addr1) ||
-                        ieee80211_is_s1g_beacon(hdr->frame_control);
+       bool multicast;
        static const u8 nan_network_id[ETH_ALEN] __aligned(2) = {
                0x51, 0x6F, 0x9A, 0x01, 0x00, 0x00
        };
 
+       if (ieee80211_is_s1g_beacon(hdr->frame_control))
+               return sdata->vif.type == NL80211_IFTYPE_STATION && bssid;
+
+       multicast = is_multicast_ether_addr(hdr->addr1);
+
        switch (sdata->vif.type) {
        case NL80211_IFTYPE_STATION:
                if (!bssid && !sdata->u.mgd.use_4addr)
@@ -5212,6 +5219,11 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
                hdr = (struct ieee80211_hdr *)rx->skb->data;
        }
 
+       if (ieee80211_is_s1g_beacon(hdr->frame_control)) {
+               ieee80211_invoke_rx_handlers(rx);
+               return true;
+       }
+
        /* Store a copy of the pre-translated link addresses for SW crypto */
        if (unlikely(is_unicast_ether_addr(hdr->addr1) &&
                     !ieee80211_is_data(hdr->frame_control)))
@@ -5301,6 +5313,13 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
        struct sta_info *sta;
        int link_id = -1;
 
+       if (ieee80211_is_s1g_beacon(hdr->frame_control)) {
+               if (!ieee80211_rx_data_set_sta(rx, NULL, -1))
+                       return false;
+
+               return ieee80211_prepare_and_rx_handle(rx, skb, consume);
+       }
+
        /*
         * Look up link station first, in case there's a
         * chance that they might have a link address that
@@ -5376,6 +5395,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                        err = -ENOBUFS;
                else
                        err = skb_linearize(skb);
+       } else if (ieee80211_is_s1g_beacon(fc)) {
+               size_t s1g_hdr_len = offsetof(struct ieee80211_ext,
+                                             u.s1g_beacon.variable) +
+                                    ieee80211_s1g_optional_len(fc);
+
+               if (skb->len < s1g_hdr_len)
+                       err = -ENOBUFS;
+               else
+                       err = skb_linearize(skb);
+       } else if (ieee80211_is_ext(fc)) {
+               err = -EINVAL;
        } else {
                err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
        }

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index f6d4ae4127c8738dff653e27f85df2ec4d7caab9..59f73dabe6e0ac16288fc3f2ff72819d35714a7c 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -73,6 +73,9 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
        if (ieee80211_is_s1g_beacon(fc)) {
                struct ieee80211_ext *ext = (void *) hdr;
 
+               if (len < offsetofend(struct ieee80211_ext, u.s1g_beacon.sa))
+                       return NULL;
+
                return ext->u.s1g_beacon.sa;
        }