wifi: virt_wifi: avoid reporting connection success with wrong SSID

When user issues a connection with a different SSID than the one
virt_wifi has advertised, the __cfg80211_connect_result() will
trigger the warning: WARN_ON(bss_not_found).

The issue is because the connection code in virt_wifi does not
check the SSID from user space (it only checks the BSSID), and
virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS
even if the SSID is different from the one virt_wifi has advertised.
Eventually cfg80211 won't be able to find the cfg80211_bss and generate
the warning.

Fixed it by checking the SSID (from user space) in the connection code.

Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device")
Reported-by: syzbot+d6eb9cee2885ec06f5e3@syzkaller.appspotmail.com
Signed-off-by: En-Wei Wu <en-wei.wu@canonical.com>
Link: https://patch.msgid.link/20240705023756.10954-1-en-wei.wu@canonical.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/virtual/virt_wifi.c b/drivers/net/wireless/virtual/virt_wifi.c
index 6a84ec58d618bcbf966dab6e38cfe02b886a712f..d2271a7644a0183cc3da953c3a578344d9280b5d 100644 (file)
--- a/drivers/net/wireless/virtual/virt_wifi.c
+++ b/drivers/net/wireless/virtual/virt_wifi.c
@@ -136,6 +136,8 @@ static struct ieee80211_supported_band band_5ghz = {
 /* Assigned at module init. Guaranteed locally-administered and unicast. */
 static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {};
 
+#define VIRT_WIFI_SSID "VirtWifi"
+
 static void virt_wifi_inform_bss(struct wiphy *wiphy)
 {
        u64 tsf = div_u64(ktime_get_boottime_ns(), 1000);
@@ -146,8 +148,8 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy)
                u8 ssid[8];
        } __packed ssid = {
                .tag = WLAN_EID_SSID,
-               .len = 8,
-               .ssid = "VirtWifi",
+               .len = strlen(VIRT_WIFI_SSID),
+               .ssid = VIRT_WIFI_SSID,
        };
 
        informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
@@ -213,6 +215,8 @@ struct virt_wifi_netdev_priv {
        struct net_device *upperdev;
        u32 tx_packets;
        u32 tx_failed;
+       u32 connect_requested_ssid_len;
+       u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN];
        u8 connect_requested_bss[ETH_ALEN];
        bool is_up;
        bool is_connected;
@@ -229,6 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev,
        if (priv->being_deleted || !priv->is_up)
                return -EBUSY;
 
+       if (!sme->ssid)
+               return -EINVAL;
+
+       priv->connect_requested_ssid_len = sme->ssid_len;
+       memcpy(priv->connect_requested_ssid, sme->ssid, sme->ssid_len);
+
        could_schedule = schedule_delayed_work(&priv->connect, HZ * 2);
        if (!could_schedule)
                return -EBUSY;
@@ -252,12 +262,15 @@ static void virt_wifi_connect_complete(struct work_struct *work)
                container_of(work, struct virt_wifi_netdev_priv, connect.work);
        u8 *requested_bss = priv->connect_requested_bss;
        bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid);
+       bool right_ssid = priv->connect_requested_ssid_len == strlen(VIRT_WIFI_SSID) &&
+                         !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID,
+                                 priv->connect_requested_ssid_len);
        u16 status = WLAN_STATUS_SUCCESS;
 
        if (is_zero_ether_addr(requested_bss))
                requested_bss = NULL;
 
-       if (!priv->is_up || (requested_bss && !right_addr))
+       if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid)
                status = WLAN_STATUS_UNSPECIFIED_FAILURE;
        else
                priv->is_connected = true;