cfg80211/mac80211: make ieee80211_send_layer2_update a public function

CVE-2019-5108

Make ieee80211_send_layer2_update() a common function so other drivers
can re-use it.

Signed-off-by: Dedy Lansky <dlansky@codeaurora.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(backported from commit 30ca1aa536211f5ac3de0173513a7a99a98a97f3)
[ Connor Kuehl: context adjustments ]
Signed-off-by: Connor Kuehl <connor.kuehl@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index c45fe070e39f3a9014a3aae499e6c5e462982eaa..f205f3af268684284fab4d239804e90c595fc749 100644 (file)
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4466,6 +4466,17 @@ static inline const u8 *cfg80211_find_ext_ie(u8 ext_eid, const u8 *ies, int len)
 const u8 *cfg80211_find_vendor_ie(unsigned int oui, int oui_type,
                                  const u8 *ies, int len);
 
+/**
+ * cfg80211_send_layer2_update - send layer 2 update frame
+ *
+ * @dev: network device
+ * @addr: STA MAC address
+ *
+ * Wireless drivers can use this function to update forwarding tables in bridge
+ * devices upon STA association.
+ */
+void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr);
+
 /**
  * DOC: Regulatory enforcement infrastructure
  *

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8168c667d91d92390576576a4125c8679c2db8a5..f236a990638fc9db99b5cd14bd8f04ead18ffee5 100644 (file)
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1089,50 +1089,6 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
        return 0;
 }
 
-/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
-struct iapp_layer2_update {
-       u8 da[ETH_ALEN];        /* broadcast */
-       u8 sa[ETH_ALEN];        /* STA addr */
-       __be16 len;             /* 6 */
-       u8 dsap;                /* 0 */
-       u8 ssap;                /* 0 */
-       u8 control;
-       u8 xid_info[3];
-} __packed;
-
-static void ieee80211_send_layer2_update(struct sta_info *sta)
-{
-       struct iapp_layer2_update *msg;
-       struct sk_buff *skb;
-
-       /* Send Level 2 Update Frame to update forwarding tables in layer 2
-        * bridge devices */
-
-       skb = dev_alloc_skb(sizeof(*msg));
-       if (!skb)
-               return;
-       msg = skb_put(skb, sizeof(*msg));
-
-       /* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
-        * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
-
-       eth_broadcast_addr(msg->da);
-       memcpy(msg->sa, sta->sta.addr, ETH_ALEN);
-       msg->len = htons(6);
-       msg->dsap = 0;
-       msg->ssap = 0x01;       /* NULL LSAP, CR Bit: Response */
-       msg->control = 0xaf;    /* XID response lsb.1111F101.
-                                * F=0 (no poll command; unsolicited frame) */
-       msg->xid_info[0] = 0x81;        /* XID format identifier */
-       msg->xid_info[1] = 1;   /* LLC types/classes: Type 1 LLC */
-       msg->xid_info[2] = 0;   /* XID sender's receive window size (RW) */
-
-       skb->dev = sta->sdata->dev;
-       skb->protocol = eth_type_trans(skb, sta->sdata->dev);
-       memset(skb->cb, 0, sizeof(skb->cb));
-       netif_rx_ni(skb);
-}
-
 static int sta_apply_auth_flags(struct ieee80211_local *local,
                                struct sta_info *sta,
                                u32 mask, u32 set)
@@ -1496,7 +1452,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        }
 
        if (layer2_update)
-               ieee80211_send_layer2_update(sta);
+               cfg80211_send_layer2_update(sta->sdata->dev, sta->sta.addr);
 
        rcu_read_unlock();
 
@@ -1598,7 +1554,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
                        ieee80211_vif_inc_num_mcast(sta->sdata);
 
-               ieee80211_send_layer2_update(sta);
+               cfg80211_send_layer2_update(sta->sdata->dev, sta->sta.addr);
        }
 
        err = sta_apply_parameters(local, sta, params);

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 801b61ae1623d9d093963adb428c18cc05110441..cd8a3e63fd73182cd01b1af3e9b5043ae0fe121b 100644 (file)
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1814,6 +1814,51 @@ const unsigned char bridge_tunnel_header[] __aligned(2) =
        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
 EXPORT_SYMBOL(bridge_tunnel_header);
 
+/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
+struct iapp_layer2_update {
+       u8 da[ETH_ALEN];        /* broadcast */
+       u8 sa[ETH_ALEN];        /* STA addr */
+       __be16 len;             /* 6 */
+       u8 dsap;                /* 0 */
+       u8 ssap;                /* 0 */
+       u8 control;
+       u8 xid_info[3];
+} __packed;
+
+void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr)
+{
+       struct iapp_layer2_update *msg;
+       struct sk_buff *skb;
+
+       /* Send Level 2 Update Frame to update forwarding tables in layer 2
+        * bridge devices */
+
+       skb = dev_alloc_skb(sizeof(*msg));
+       if (!skb)
+               return;
+       msg = skb_put(skb, sizeof(*msg));
+
+       /* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
+        * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
+
+       eth_broadcast_addr(msg->da);
+       ether_addr_copy(msg->sa, addr);
+       msg->len = htons(6);
+       msg->dsap = 0;
+       msg->ssap = 0x01;       /* NULL LSAP, CR Bit: Response */
+       msg->control = 0xaf;    /* XID response lsb.1111F101.
+                                * F=0 (no poll command; unsolicited frame) */
+       msg->xid_info[0] = 0x81;        /* XID format identifier */
+       msg->xid_info[1] = 1;   /* LLC types/classes: Type 1 LLC */
+       msg->xid_info[2] = 0;   /* XID sender's receive window size (RW) */
+
+       skb->dev = dev;
+       skb->protocol = eth_type_trans(skb, dev);
+       memset(skb->cb, 0, sizeof(skb->cb));
+       netif_rx_ni(skb);
+}
+EXPORT_SYMBOL(cfg80211_send_layer2_update);
+
 bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
                             bool is_4addr, u8 check_swif)