Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 864a6040 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: clear sequence/fragment number in QoS-null frames 



Avoid leaking data by sending uninitialized memory and setting an
invalid (non-zero) fragment number (the sequence number is ignored
anyway) by setting the seq_ctrl field to zero.

Cc: stable@vger.kernel.org
Fixes: 3f52b7e3 ("mac80211: mesh power save basics")
Fixes: ce662b44 ("mac80211: send (QoS) Null if no buffered frames")
Reviewed-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent bc00a91d

net/mac80211/mesh_ps.c

+1 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ static struct sk_buff *mps_qos_null_get(struct sta_info *sta) 
				      sdata->vif.addr);

	nullfunc->frame_control = fc;

	nullfunc->duration_id = 0;

	nullfunc->seq_ctrl = 0;

	/* no address resolution for this frame -> set addr 1 immediately */

	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);

	memset(skb_put(skb, 2), 0, 2); /* append QoS control field */

net/mac80211/sta_info.c

+1 −0
Original line number Diff line number Diff line
@@ -1206,6 +1206,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata, 
	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);

	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);

	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);

	nullfunc->seq_ctrl = 0;



	skb->priority = tid;

	skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);