[PATCH] wifi: cfg80211: reject overflowing scan frequencies

[PATCH] wifi: cfg80211: reject overflowing scan frequencies

[Kyle Zeng]

validate_scan_freqs() checks for duplicate raw u32 frequencies, but scan
requests later convert MHz to kHz using 32-bit arithmetic. Values spaced
2^29 MHz apart therefore pass the duplicate check and resolve to the
same registered channel. This breaks the guarantee that drivers receive
no more channels than they registered. For example, 120 entries formed
from aliases of 15 5-GHz channels overrun mac80211_hwsim's 113-entry
survey array.

Reject MHz values greater than U32_MAX / 1000 in the shared validator
and keep the subsequent conversions unsigned. Pass the unit into the
validator so that raw kHz input remains unchanged. Apply the same check
to scheduled scans, including WoWLAN net-detect, which use the same
MHz conversion.

Fixes: 934f4c7dd3a5 ("cfg80211: express channels with a KHz component")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
I have a reproducer for this issue and can share via DM

 net/wireless/nl80211.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d790e204aee3..6cfa12191089 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -11470,14 +11470,18 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
 }
 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
 
-static int validate_scan_freqs(struct nlattr *freqs)
+static int validate_scan_freqs(struct nlattr *freqs, bool khz)
 {
 	struct nlattr *attr1, *attr2;
 	int n_channels = 0, tmp1, tmp2;
 
-	nla_for_each_nested(attr1, freqs, tmp1)
+	nla_for_each_nested(attr1, freqs, tmp1) {
 		if (nla_len(attr1) != sizeof(u32))
 			return 0;
+		/* Avoid aliases when MHz values are converted to kHz. */
+		if (!khz && nla_get_u32(attr1) > U32_MAX / 1000)
+			return 0;
+	}
 
 	nla_for_each_nested(attr1, freqs, tmp1) {
 		n_channels++;
@@ -11786,7 +11790,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 		scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
 
 	if (scan_freqs) {
-		n_channels = validate_scan_freqs(scan_freqs);
+		n_channels = validate_scan_freqs(scan_freqs, scan_freqs_khz);
 		if (!n_channels)
 			return -EINVAL;
 	} else {
@@ -11828,7 +11832,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 		/* user specified, bail out if channel not found */
 		nla_for_each_nested(attr, scan_freqs, tmp) {
 			struct ieee80211_channel *chan;
-			int freq = nla_get_u32(attr);
+			u32 freq = nla_get_u32(attr);
 
 			if (!scan_freqs_khz)
 				freq = MHZ_TO_KHZ(freq);
@@ -12118,7 +12122,7 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
 
 	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
 		n_channels = validate_scan_freqs(
-				attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
+				attrs[NL80211_ATTR_SCAN_FREQUENCIES], false);
 		if (!n_channels)
 			return ERR_PTR(-EINVAL);
 	} else {
@@ -12276,7 +12280,8 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
 				    tmp) {
 			struct ieee80211_channel *chan;
 
-			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
+			chan = ieee80211_get_channel_khz(wiphy,
+							 MHZ_TO_KHZ(nla_get_u32(attr)));
 
 			if (!chan) {
 				err = -EINVAL;

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
-- 
2.56.0