Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7dd111e8 authored by Johannes Berg's avatar Johannes Berg
Browse files

wireless: drop invalid mesh address extension frames 



The mesh header can have address extension by a 4th
or a 5th and 6th address, but never both. Drop such
frames in 802.11 -> 802.3 conversion along with any
frames that have the wrong extension.

Cc: stable@vger.kernel.org
Reviewed-by: default avatarJavier Cardona <javier@cozybit.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent badecb00

net/wireless/util.c

+6 −5
Original line number Diff line number Diff line
@@ -312,18 +312,15 @@ EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb); 
static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)

{

	int ae = meshhdr->flags & MESH_FLAGS_AE;

	/* 7.1.3.5a.2 */

	/* 802.11-2012, 8.2.4.7.3 */

	switch (ae) {

	default:

	case 0:

		return 6;

	case MESH_FLAGS_AE_A4:

		return 12;

	case MESH_FLAGS_AE_A5_A6:

		return 18;

	case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):

		return 24;

	default:

		return 6;

	}

}
@@ -373,6 +370,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr, 
			/* make sure meshdr->flags is on the linear part */

			if (!pskb_may_pull(skb, hdrlen + 1))

				return -1;

			if (meshdr->flags & MESH_FLAGS_AE_A4)

				return -1;

			if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {

				skb_copy_bits(skb, hdrlen +

					offsetof(struct ieee80211s_hdr, eaddr1),
@@ -397,6 +396,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr, 
			/* make sure meshdr->flags is on the linear part */

			if (!pskb_may_pull(skb, hdrlen + 1))

				return -1;

			if (meshdr->flags & MESH_FLAGS_AE_A5_A6)

				return -1;

			if (meshdr->flags & MESH_FLAGS_AE_A4)

				skb_copy_bits(skb, hdrlen +

					offsetof(struct ieee80211s_hdr, eaddr1),