mwifiex: Don't abort on small, spec-compliant vendor IEs
authorBrian Norris <briannorris@chromium.org>
Sat, 15 Jun 2019 00:13:20 +0000 (17:13 -0700)
committerKalle Valo <kvalo@codeaurora.org>
Mon, 24 Jun 2019 13:22:50 +0000 (16:22 +0300)
commit63d7ef36103d26f20325a921ecc96a3288560146
treed75e9b8d6adee2d5596a97be1bdc7feb5c69f0f4
parent608fd7214323bd3bb2c288f68253e5bb634d4f49
mwifiex: Don't abort on small, spec-compliant vendor IEs

Per the 802.11 specification, vendor IEs are (at minimum) only required
to contain an OUI. A type field is also included in ieee80211.h (struct
ieee80211_vendor_ie) but doesn't appear in the specification. The
remaining fields (subtype, version) are a convention used in WMM
headers.

Thus, we should not reject vendor-specific IEs that have only the
minimum length (3 bytes) -- we should skip over them (since we only want
to match longer IEs, that match either WMM or WPA formats). We can
reject elements that don't have the minimum-required 3 byte OUI.

While we're at it, move the non-standard subtype and version fields into
the WMM structs, to avoid this confusion in the future about generic
"vendor header" attributes.

Fixes: 685c9b7750bf ("mwifiex: Abort at too short BSS descriptor element")
Cc: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/marvell/mwifiex/fw.h
drivers/net/wireless/marvell/mwifiex/scan.c
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
drivers/net/wireless/marvell/mwifiex/wmm.c