| From 7dd111e8ee10cc6816669eabcad3334447673236 Mon Sep 17 00:00:00 2001 |
| From: Johannes Berg <johannes.berg@intel.com> |
| Date: Thu, 25 Oct 2012 21:51:59 +0200 |
| Subject: wireless: drop invalid mesh address extension frames |
| |
| From: Johannes Berg <johannes.berg@intel.com> |
| |
| commit 7dd111e8ee10cc6816669eabcad3334447673236 upstream. |
| |
| The mesh header can have address extension by a 4th |
| or a 5th and 6th address, but never both. Drop such |
| frames in 802.11 -> 802.3 conversion along with any |
| frames that have the wrong extension. |
| |
| Reviewed-by: Javier Cardona <javier@cozybit.com> |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/wireless/util.c | 11 ++++++----- |
| 1 file changed, 6 insertions(+), 5 deletions(-) |
| |
| --- a/net/wireless/util.c |
| +++ b/net/wireless/util.c |
| @@ -298,18 +298,15 @@ EXPORT_SYMBOL(ieee80211_get_hdrlen_from_ |
| static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr) |
| { |
| int ae = meshhdr->flags & MESH_FLAGS_AE; |
| - /* 7.1.3.5a.2 */ |
| + /* 802.11-2012, 8.2.4.7.3 */ |
| switch (ae) { |
| + default: |
| case 0: |
| return 6; |
| case MESH_FLAGS_AE_A4: |
| return 12; |
| case MESH_FLAGS_AE_A5_A6: |
| return 18; |
| - case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6): |
| - return 24; |
| - default: |
| - return 6; |
| } |
| } |
| |
| @@ -359,6 +356,8 @@ int ieee80211_data_to_8023(struct sk_buf |
| /* make sure meshdr->flags is on the linear part */ |
| if (!pskb_may_pull(skb, hdrlen + 1)) |
| return -1; |
| + if (meshdr->flags & MESH_FLAGS_AE_A4) |
| + return -1; |
| if (meshdr->flags & MESH_FLAGS_AE_A5_A6) { |
| skb_copy_bits(skb, hdrlen + |
| offsetof(struct ieee80211s_hdr, eaddr1), |
| @@ -383,6 +382,8 @@ int ieee80211_data_to_8023(struct sk_buf |
| /* make sure meshdr->flags is on the linear part */ |
| if (!pskb_may_pull(skb, hdrlen + 1)) |
| return -1; |
| + if (meshdr->flags & MESH_FLAGS_AE_A5_A6) |
| + return -1; |
| if (meshdr->flags & MESH_FLAGS_AE_A4) |
| skb_copy_bits(skb, hdrlen + |
| offsetof(struct ieee80211s_hdr, eaddr1), |
