Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e7ec86f5 authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville
Browse files

mac80211: validate TIM IE length (redux) 



The TIM IE must not be shorter than 4 bytes, so verify that
when parsing it and use the proper type. To ease that adjust
struct ieee80211_tim_ie to have a virtual bitmap of size
at least 1.

Also check that the TIM IE is actually present before trying
to parse it!

Because other people may need the function, make it a static
inline in ieee80211.h.

(The original "mac80211: validate TIM IE length" was a minimal fix for
2.6.30.  This purports to be the full, correct fix. -- JWL)

Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent ba44cb72

include/linux/ieee80211.h

+31 −1
Original line number Diff line number Diff line
@@ -540,7 +540,7 @@ struct ieee80211_tim_ie { 
	u8 dtim_period;

	u8 bitmap_ctrl;

	/* variable size: 1 - 251 bytes */

	u8 virtual_map[0];

	u8 virtual_map[1];

} __attribute__ ((packed));



#define WLAN_SA_QUERY_TR_ID_LEN 16
@@ -1392,4 +1392,34 @@ static inline unsigned long ieee80211_tu_to_usec(unsigned long tu) 
	return 1024 * tu;

}



/**

 * ieee80211_check_tim - check if AID bit is set in TIM

 * @tim: the TIM IE

 * @tim_len: length of the TIM IE

 * @aid: the AID to look for

 */

static inline bool ieee80211_check_tim(struct ieee80211_tim_ie *tim,

				       u8 tim_len, u16 aid)

{

	u8 mask;

	u8 index, indexn1, indexn2;



	if (unlikely(!tim || tim_len < sizeof(*tim)))

		return false;



	aid &= 0x3fff;

	index = aid / 8;

	mask  = 1 << (aid & 7);



	indexn1 = tim->bitmap_ctrl & 0xfe;

	indexn2 = tim_len + indexn1 - 4;



	if (index < indexn1 || index > indexn2)

		return false;



	index -= indexn1;



	return !!(tim->virtual_map[index] & mask);

}



#endif /* LINUX_IEEE80211_H */

net/mac80211/ieee80211_i.h

+1 −1
Original line number Diff line number Diff line
@@ -832,7 +832,7 @@ struct ieee802_11_elems { 
	u8 *fh_params;

	u8 *ds_params;

	u8 *cf_params;

	u8 *tim;

	struct ieee80211_tim_ie *tim;

	u8 *ibss_params;

	u8 *challenge;

	u8 *wpa;

net/mac80211/mlme.c

+2 −25
Original line number Diff line number Diff line
@@ -675,30 +675,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local, 
	}

}



static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)

{

	u8 mask;

	u8 index, indexn1, indexn2;

	struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;



	if (unlikely(!tim || elems->tim_len < 4))

		return false;



	aid &= 0x3fff;

	index = aid / 8;

	mask  = 1 << (aid & 7);



	indexn1 = tim->bitmap_ctrl & 0xfe;

	indexn2 = elems->tim_len + indexn1 - 4;



	if (index < indexn1 || index > indexn2)

		return false;



	index -= indexn1;



	return !!(tim->virtual_map[index] & mask);

}



static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,

					   u16 capab, bool erp_valid, u8 erp)

{
@@ -1806,7 +1782,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, 
					  care_about_ies, ncrc);



	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)

		directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);

		directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,

						   ifmgd->aid);



	ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim));

net/mac80211/util.c

+4 −2
Original line number Diff line number Diff line
@@ -588,8 +588,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, 
			elems->cf_params_len = elen;

			break;

		case WLAN_EID_TIM:

			elems->tim = pos;

			if (elen >= sizeof(struct ieee80211_tim_ie)) {

				elems->tim = (void *)pos;

				elems->tim_len = elen;

			}

			break;

		case WLAN_EID_IBSS_PARAMS:

			elems->ibss_params = pos;