[PATCH wireless 1/2] wifi: cfg80211: don't truncate the merged MBSSID profile length

[PATCH wireless 1/2] wifi: cfg80211: don't truncate the merged MBSSID profile length

[Wahid Khan]

cfg80211_parse_mbssid_data() keeps the length of a non-transmitted BSSID
profile in a u8. cfg80211_merge_profile() returns a size_t, and it
concatenates a profile that is split over several Multiple BSSID
elements, so the merged length can be well above 255 even though every
single sub-element is at most 255 bytes long.

The value is then cut to its low 8 bits. A 300 byte profile is handled
as a 44 byte one: the elements after the cut are lost from the generated
non-transmitted BSS, and if the Multiple BSSID-Index element lies past
the cut the BSS is dropped altogether. Any AP in range can send such a
profile.

The multi-link code further down in the same file already uses a signed
size type for the profile length. Do the same here, cfg80211_find_ie()
and cfg80211_gen_new_ie() take a size_t anyway.

Fixes: fe806e4992c9 ("cfg80211: support profile split between elements")
Cc: stable@vger.kernel.org
Signed-off-by: Wahid Khan <wahidzk0091@gmail.com>
---
 net/wireless/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index ac56338f0f43..8e9ce8336876 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -2592,7 +2592,7 @@ cfg80211_parse_mbssid_data(struct wiphy *wiphy,
 		if (elem->data[0] < 1 || (int)elem->data[0] > 8)
 			continue;
 		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
-			u8 profile_len;
+			size_t profile_len;
 
 			if (sub->id != 0 || sub->datalen < 4) {
 				/* not a valid BSS profile */
-- 
2.56.0

[PATCH wireless 2/2] wifi: cfg80211: test a split MBSSID profile longer than 255 bytes

[Wahid Khan]

Add a KUnit test with a non-transmitted BSSID profile that is split over
two Multiple BSSID elements and is 300 bytes long once merged. The last
element of the profile must show up in the generated BSS. Before the
previous change the profile length was cut to 44 bytes and the test
failed.

Signed-off-by: Wahid Khan <wahidzk0091@gmail.com>
---
 net/wireless/tests/scan.c | 104 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)

diff --git a/net/wireless/tests/scan.c b/net/wireless/tests/scan.c
index 8c20278b5d3a..01dcabf9dbfe 100644
--- a/net/wireless/tests/scan.c
+++ b/net/wireless/tests/scan.c
@@ -402,6 +402,109 @@ static void test_inform_bss_ssid_only(struct kunit *test)
 	cfg80211_put_bss(wiphy, bss);
 }
 
+static void test_inform_bss_mbssid_long_profile(struct kunit *test)
+{
+	struct inform_bss ctx = {
+		.test = test,
+	};
+	struct wiphy *wiphy = T_WIPHY(test, ctx);
+	struct t_wiphy_priv *w_priv = wiphy_priv(wiphy);
+	struct cfg80211_inform_bss inform_bss = {
+		.signal = 50,
+		.drv_data = &ctx,
+	};
+	const u8 bssid[ETH_ALEN] = { 0x10, 0x22, 0x33, 0x44, 0x55, 0x60 };
+	const u8 marker[] = { WLAN_EID_VENDOR_SPECIFIC, 6, 0x00, 0x11, 0x22,
+			      0x77, 'M', 'K' };
+	struct cfg80211_bss *tx_bss, *bss;
+	const struct cfg80211_bss_ies *ies;
+	u8 *input, *pos;
+	size_t len;
+
+	wiphy->support_mbssid = 1;
+	w_priv->ops->inform_bss = inform_bss_inc_counter;
+
+	inform_bss.chan = ieee80211_get_channel_khz(wiphy, MHZ_TO_KHZ(2412));
+	KUNIT_ASSERT_NOT_NULL(test, inform_bss.chan);
+
+	input = kunit_kzalloc(test, 1024, GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, input);
+	pos = input;
+
+	/* transmitting BSS SSID */
+	*pos++ = WLAN_EID_SSID;
+	*pos++ = 2;
+	*pos++ = 'T';
+	*pos++ = 'X';
+
+	/*
+	 * First MBSSID element: a 200 byte non-transmitted profile start,
+	 * the profile continues in the next MBSSID element.
+	 */
+	*pos++ = WLAN_EID_MULTIPLE_BSSID;
+	*pos++ = 1 + 2 + 200;
+	*pos++ = 1;			/* max BSSID indicator */
+	*pos++ = 0;			/* nontransmitted BSSID profile */
+	*pos++ = 200;
+	*pos++ = WLAN_EID_NON_TX_BSSID_CAP;
+	*pos++ = 2;
+	*pos++ = 0x34;
+	*pos++ = 0x12;
+	*pos++ = WLAN_EID_SSID;
+	*pos++ = 2;
+	*pos++ = 'N';
+	*pos++ = 'T';
+	*pos++ = WLAN_EID_MULTI_BSSID_IDX;
+	*pos++ = 1;
+	*pos++ = 1;
+	*pos++ = WLAN_EID_VENDOR_SPECIFIC;
+	*pos++ = 187;
+	*pos++ = 0xaa;
+	*pos++ = 0xbb;
+	*pos++ = 0xcc;
+	pos += 184;
+
+	/* second MBSSID element: continuation of the profile, 100 bytes */
+	*pos++ = WLAN_EID_MULTIPLE_BSSID;
+	*pos++ = 1 + 2 + 100;
+	*pos++ = 1;
+	*pos++ = 0;
+	*pos++ = 100;
+	*pos++ = WLAN_EID_VENDOR_SPECIFIC;
+	*pos++ = 90;
+	*pos++ = 0xaa;
+	*pos++ = 0xbb;
+	*pos++ = 0xcc;
+	pos += 87;
+	memcpy(pos, marker, sizeof(marker));
+	pos += sizeof(marker);
+	len = pos - input;
+
+	tx_bss = cfg80211_inform_bss_data(wiphy, &inform_bss,
+					  CFG80211_BSS_FTYPE_PRESP, bssid,
+					  0x1000, 0x1234, 100,
+					  input, len, GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, tx_bss);
+
+	bss = cfg80211_get_bss(wiphy, NULL, NULL, "NT", 2,
+			       IEEE80211_BSS_TYPE_ANY, IEEE80211_PRIVACY_ANY);
+	KUNIT_ASSERT_NOT_NULL(test, bss);
+
+	/* the 300 byte merged profile must not be cut at 300 % 256 */
+	rcu_read_lock();
+	ies = rcu_dereference(bss->ies);
+	KUNIT_EXPECT_NOT_NULL(test, ies);
+	if (ies)
+		KUNIT_EXPECT_NOT_NULL(test,
+				      cfg80211_find_vendor_elem(0x001122, 0x77,
+								ies->data,
+								ies->len));
+	rcu_read_unlock();
+
+	cfg80211_put_bss(wiphy, bss);
+	cfg80211_put_bss(wiphy, tx_bss);
+}
+
 static void test_get_bss_miss_reason(struct kunit *test)
 {
 	struct inform_bss ctx = {
@@ -973,6 +1076,7 @@ kunit_test_suite(gen_new_ie);
 
 static struct kunit_case inform_bss_test_cases[] = {
 	KUNIT_CASE(test_inform_bss_ssid_only),
+	KUNIT_CASE(test_inform_bss_mbssid_long_profile),
 	KUNIT_CASE(test_get_bss_miss_reason),
 	KUNIT_CASE_PARAM(test_inform_bss_ml_sta, inform_bss_ml_sta_gen_params),
 	{}
-- 
2.56.0