UBUNTU: SAUCE: wifi: mac80211: fix crash in beacon protection for P2P-device

If beacon protection is active but the beacon cannot be
decrypted or is otherwise malformed, we call the cfg80211
API to report this to userspace, but that uses a netdev
pointer, which isn't present for P2P-Device. Fix this to
call it only conditionally to ensure cfg80211 won't crash
in the case of P2P-Device.

This fixes CVE-2022-42722.

Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 9eaf183af741 ("mac80211: Report beacon protection failures to user space")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
CVE-2022-42722
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 743e97ba352c86b0bfc92095ea1d60c7bfa99ded..175ead6b19cb4aded8095f9ee2da3f0ccf601891 100644 (file)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1982,10 +1982,11 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
                if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
                    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
-                   NUM_DEFAULT_BEACON_KEYS) {
-                       cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
-                                                    skb->data,
-                                                    skb->len);
+                                  NUM_DEFAULT_BEACON_KEYS) {
+                       if (rx->sdata->dev)
+                               cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+                                                            skb->data,
+                                                            skb->len);
                        return RX_DROP_MONITOR; /* unexpected BIP keyidx */
                }
 
@@ -2133,7 +2134,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
        /* either the frame has been decrypted or will be dropped */
        status->flag |= RX_FLAG_DECRYPTED;
 
-       if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE))
+       if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE &&
+                    rx->sdata->dev))
                cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
                                             skb->data, skb->len);