| From 8bdf210960af295e80c4f3e26d778cab7693e8a2 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 16 Jun 2025 17:18:38 +0200 |
| Subject: wifi: mac80211: drop invalid source address OCB frames |
| |
| From: Johannes Berg <johannes.berg@intel.com> |
| |
| [ Upstream commit d1b1a5eb27c4948e8811cf4dbb05aaf3eb10700c ] |
| |
| In OCB, don't accept frames from invalid source addresses |
| (and in particular don't try to create stations for them), |
| drop the frames instead. |
| |
| Reported-by: syzbot+8b512026a7ec10dcbdd9@syzkaller.appspotmail.com |
| Closes: https://lore.kernel.org/r/6788d2d9.050a0220.20d369.0028.GAE@google.com/ |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Tested-by: syzbot+8b512026a7ec10dcbdd9@syzkaller.appspotmail.com |
| Link: https://patch.msgid.link/20250616171838.7433379cab5d.I47444d63c72a0bd58d2e2b67bb99e1fea37eec6f@changeid |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/mac80211/rx.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c |
| index 65fea564c9c00..b46c4c770608c 100644 |
| --- a/net/mac80211/rx.c |
| +++ b/net/mac80211/rx.c |
| @@ -4097,6 +4097,10 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) |
| if (!multicast && |
| !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1)) |
| return false; |
| + /* reject invalid/our STA address */ |
| + if (!is_valid_ether_addr(hdr->addr2) || |
| + ether_addr_equal(sdata->dev->dev_addr, hdr->addr2)) |
| + return false; |
| if (!rx->sta) { |
| int rate_idx; |
| if (status->encoding != RX_ENC_LEGACY) |
| -- |
| 2.39.5 |
| |
