Skip to content

Commit

Permalink
wifi: cfg80211: reject auth/assoc to AP with our address
Browse files Browse the repository at this point in the history
If the AP uses our own address as its MLD address or BSSID, then
clearly something's wrong. Reject such connections so we don't
try and fail later.

Reported-by: syzbot+2676771ed06a6df166ad@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  • Loading branch information
jmberg-intel committed Aug 22, 2023
1 parent 19e4a47 commit 5d4e04b
Showing 1 changed file with 13 additions and 0 deletions.
13 changes: 13 additions & 0 deletions net/wireless/mlme.c
Original file line number Diff line number Diff line change
Expand Up @@ -281,6 +281,11 @@ int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr))
return -EALREADY;

if (ether_addr_equal(req->bss->bssid, dev->dev_addr) ||
(req->link_id >= 0 &&
ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
return -EINVAL;

return rdev_auth(rdev, dev, req);
}

Expand Down Expand Up @@ -335,13 +340,21 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
if (req->links[i].bss == req->links[j].bss)
return -EINVAL;
}

if (ether_addr_equal(req->links[i].bss->bssid, dev->dev_addr))
return -EINVAL;
}

if (wdev->connected &&
(!req->prev_bssid ||
!ether_addr_equal(wdev->u.client.connected_addr, req->prev_bssid)))
return -EALREADY;

if ((req->bss && ether_addr_equal(req->bss->bssid, dev->dev_addr)) ||
(req->link_id >= 0 &&
ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
return -EINVAL;

cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
rdev->wiphy.ht_capa_mod_mask);
cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
Expand Down

0 comments on commit 5d4e04b

Please sign in to comment.