wifi: cfg80211: reject auth/assoc to AP with our address

[ Upstream commit 5d4e04bf3a0f098bd9033de3a5291810fa14c7a6 ]

If the AP uses our own address as its MLD address or BSSID, then
clearly something's wrong. Reject such connections so we don't
try and fail later.

Reported-by: syzbot+2676771ed06a6df166ad@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 581df7f4c524091ac6c7a3b1a21ef54e2986a622..e7fa0608341d895f0562584e740b6c5308da31ed 100644 (file)
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -277,6 +277,11 @@ int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
            ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr))
                return -EALREADY;
 
+       if (ether_addr_equal(req->bss->bssid, dev->dev_addr) ||
+           (req->link_id >= 0 &&
+            ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
+               return -EINVAL;
+
        return rdev_auth(rdev, dev, req);
 }
 
@@ -331,6 +336,9 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                        if (req->links[i].bss == req->links[j].bss)
                                return -EINVAL;
                }
+
+               if (ether_addr_equal(req->links[i].bss->bssid, dev->dev_addr))
+                       return -EINVAL;
        }
 
        if (wdev->connected &&
@@ -338,6 +346,11 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
             !ether_addr_equal(wdev->u.client.connected_addr, req->prev_bssid)))
                return -EALREADY;
 
+       if ((req->bss && ether_addr_equal(req->bss->bssid, dev->dev_addr)) ||
+           (req->link_id >= 0 &&
+            ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
+               return -EINVAL;
+
        cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
                                  rdev->wiphy.ht_capa_mod_mask);
        cfg80211_oper_and_vht_capa(&req->vht_capa_mask,