mac80211: Allow HE operation to be longer than expected.

BugLink: https://bugs.launchpad.net/bugs/1922601
[ Upstream commit 0f7e90faddeef53a3568f449a0c3992d77510b66 ]

We observed some Cisco APs sending the following HE Operation IE in
associate response:

  ff 0a 24 f4 3f 00 01 fc ff 00 00 00

Its HE operation parameter is 0x003ff4, so the expected total length is
7 which does not match the actual length = 10. This causes association
failing with "HE AP is missing HE Capability/operation."

According to P802.11ax_D4 Table9-94, HE operation is extensible, and
according to 802.11-2016 10.27.8, STA should discard the part beyond
the maximum length and parse the truncated element.

Allow HE operation element to be longer than expected to handle this
case and future extensions.

Fixes: e4d005b80dee ("mac80211: refactor extended element parsing")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Yen-lin Lai <yenlinlai@chromium.org>
Link: https://lore.kernel.org/r/20210223051926.2653301-1-yenlinlai@chromium.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0e4d950cf907b9ef11618fc479ff3ea0c73aeb6f..9db648a91a4f68bc4644f514df0b81e763e2fa91 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -5071,7 +5071,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
                                                  ies->data, ies->len);
                if (he_oper_ie &&
-                   he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
+                   he_oper_ie[1] >= ieee80211_he_oper_size(&he_oper_ie[3]))
                        he_oper = (void *)(he_oper_ie + 3);
                else
                        he_oper = NULL;

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8d3ae6b2f95ff47d8478b0831cee735c740460d1..f4507a708965363eec5f3099fab74ac3694a5021 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -968,7 +968,7 @@ static void ieee80211_parse_extension_element(u32 *crc,
                break;
        case WLAN_EID_EXT_HE_OPERATION:
                if (len >= sizeof(*elems->he_operation) &&
-                   len == ieee80211_he_oper_size(data) - 1) {
+                   len >= ieee80211_he_oper_size(data) - 1) {
                        if (crc)
                                *crc = crc32_be(*crc, (void *)elem,
                                                elem->datalen + 2);