Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a4f1a58 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: check management frame header length 



Due to pskb_may_pull() checking the skb length, all
non-management frames are checked on input whether
their 802.11 header is fully present. Also add that
check for management frames and remove a check that
is now duplicate. This prevents accessing skb data
beyond the frame end.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 7dd111e8

net/mac80211/rx.c

+8 −4
Original line number Diff line number Diff line
@@ -1470,7 +1470,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 
	frag = sc & IEEE80211_SCTL_FRAG;



	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||

		   (rx->skb)->len < 24 ||

		   is_multicast_ether_addr(hdr->addr1))) {

		/* not fragmented */

		goto out;
@@ -2915,10 +2914,15 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 
	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))

		local->dot11ReceivedFragmentCount++;



	if (ieee80211_is_mgmt(fc))

		err = skb_linearize(skb);

	if (ieee80211_is_mgmt(fc)) {

		/* drop frame if too short for header */

		if (skb->len < ieee80211_hdrlen(fc))

			err = -ENOBUFS;

		else

			err = skb_linearize(skb);

	} else {

		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));

	}



	if (err) {

		dev_kfree_skb(skb);