wifi: mac80211: restrict public action ECSA frame handling
authorJohannes Berg <johannes.berg@intel.com>
Wed, 12 Jun 2024 12:28:36 +0000 (14:28 +0200)
committerJohannes Berg <johannes.berg@intel.com>
Wed, 26 Jun 2024 08:21:44 +0000 (10:21 +0200)
commit414e090bc41d27af8196d2f36c2e883d7b4f1478
tree6918b91b9e04c9b14a7651da5ef6c9165588db1f
parentdc494fdc1f0657b4786d4f556b0462fe5198506b
wifi: mac80211: restrict public action ECSA frame handling

Public action extended channel switch announcement (ECSA)
frames cannot be protected well, the spec is unclear about
what should happen in the presence of stations that can
receive protected dual and stations that cannot.

Mitigate these issues by not treating public action frames
as the absolute truth, only treat them as a hint to stop
transmitting (quiet mode), and do the remainder of the CSA
handling only when receiving the next beacon (or protected
action frame) that contains the CSA; or, if it doesn't,
simply stop being quiet and continue operating normally.

This limits the exposure to malicious ECSA public action
frames, since they cannot cause a disconnect now, only a
short interruption in traffic.

Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240612143037.ec7ccc45903e.Ife17d55c7ecbf98060f9c52889f3c8ba48798970@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/ibss.c
net/mac80211/ieee80211_i.h
net/mac80211/mesh.c
net/mac80211/mlme.c
net/mac80211/spectmgmt.c