Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c80d3dc authored Sep 08, 2008 by Johannes Berg Committed by John W. Linville Sep 11, 2008

mac80211: fix action frame length checks



The action frame length checks are one too small, there's not just
an action code as the comment makes you believe, there's a category
code too, and the category code is required in each action frame
(hence part of IEEE80211_MIN_ACTION_SIZE).

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent 5bda6175

net/mac80211/mesh_hwmp.c

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -581,6 +581,10 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
	size_t baselen;		size_t baselen;
	u32 last_hop_metric;		u32 last_hop_metric;

			/* need action_code */
			if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			return;

	baselen = (u8 ) mgmt->u.action.u.mesh_action.variable - (u8 ) mgmt;		baselen = (u8 ) mgmt->u.action.u.mesh_action.variable - (u8 ) mgmt;
	ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,		ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
	len - baselen, &elems);		len - baselen, &elems);

net/mac80211/mesh_plink.c

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -421,6 +421,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
	DECLARE_MAC_BUF(mac);		DECLARE_MAC_BUF(mac);
	#endif		#endif

			/* need action_code, aux */
			if (len < IEEE80211_MIN_ACTION_SIZE + 3)
			return;

	if (is_multicast_ether_addr(mgmt->da)) {		if (is_multicast_ether_addr(mgmt->da)) {
	mpl_dbg("Mesh plink: ignore frame from multicast address");		mpl_dbg("Mesh plink: ignore frame from multicast address");
	return;		return;

net/mac80211/mlme.c

+3 −2

Original line number	Original line	Diff line number	Diff line
	@@ -60,7 +60,7 @@

	#define ERP_INFO_USE_PROTECTION BIT(1)		#define ERP_INFO_USE_PROTECTION BIT(1)

	/* mgmt header + 1 byte action code */		/* mgmt header + 1 byte category code */
	#define IEEE80211_MIN_ACTION_SIZE (24 + 1)		#define IEEE80211_MIN_ACTION_SIZE (24 + 1)

	#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002		#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
	@@ -2988,7 +2988,8 @@ static void ieee80211_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
	{		{
	struct ieee80211_local *local = sdata->local;		struct ieee80211_local *local = sdata->local;

	if (len < IEEE80211_MIN_ACTION_SIZE)		/* all categories we currently handle have action_code */
			if (len < IEEE80211_MIN_ACTION_SIZE + 1)
	return;		return;

	switch (mgmt->u.action.category) {		switch (mgmt->u.action.category) {