Commit ab904521 authored by Lin Ma's avatar Lin Ma Committed by Johannes Berg
Browse files

wifi: cfg80211: pmsr: use correct nla_get_uX functions 



The commit 9bb7e0f2 ("cfg80211: add peer measurement with FTM
initiator API") defines four attributes NL80211_PMSR_FTM_REQ_ATTR_
{NUM_BURSTS_EXP}/{BURST_PERIOD}/{BURST_DURATION}/{FTMS_PER_BURST} in
following ways.

static const struct nla_policy
nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
    ...
    [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
        NLA_POLICY_MAX(NLA_U8, 15),
    [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
    [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
        NLA_POLICY_MAX(NLA_U8, 15),
    [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
        NLA_POLICY_MAX(NLA_U8, 31),
    ...
};

That is, those attributes are expected to be NLA_U8 and NLA_U16 types.
However, the consumers of these attributes in `pmsr_parse_ftm` blindly
all use `nla_get_u32`, which is incorrect and causes functionality issues
on little-endian platforms. Hence, fix them with the correct `nla_get_u8`
and `nla_get_u16` functions.

Fixes: 9bb7e0f2 ("cfg80211: add peer measurement with FTM initiator API")
Signed-off-by: default avatarLin Ma <linma@zju.edu.cn>
Link: https://msgid.link/20240521075059.47999-1-linma@zju.edu.cn


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 642f89da

net/wireless/pmsr.c

+4 −4
Original line number Diff line number Diff line
@@ -56,7 +56,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev, 
	out->ftm.burst_period = 0;

	if (tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD])

		out->ftm.burst_period =

			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD]);

			nla_get_u16(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD]);



	out->ftm.asap = !!tb[NL80211_PMSR_FTM_REQ_ATTR_ASAP];

	if (out->ftm.asap && !capa->ftm.asap) {
@@ -75,7 +75,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev, 
	out->ftm.num_bursts_exp = 0;

	if (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP])

		out->ftm.num_bursts_exp =

			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP]);

			nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP]);



	if (capa->ftm.max_bursts_exponent >= 0 &&

	    out->ftm.num_bursts_exp > capa->ftm.max_bursts_exponent) {
@@ -88,7 +88,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev, 
	out->ftm.burst_duration = 15;

	if (tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION])

		out->ftm.burst_duration =

			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION]);

			nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION]);



	out->ftm.ftms_per_burst = 0;

	if (tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST])
@@ -107,7 +107,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev, 
	out->ftm.ftmr_retries = 3;

	if (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES])

		out->ftm.ftmr_retries =

			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES]);

			nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES]);



	out->ftm.request_lci = !!tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI];

	if (out->ftm.request_lci && !capa->ftm.request_lci) {