lkml.org 
[lkml]   [2012]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 011/241] wireless: drop invalid mesh address extension frames
    Date
    3.5.7.2 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johannes Berg <johannes.berg@intel.com>

    commit 7dd111e8ee10cc6816669eabcad3334447673236 upstream.

    The mesh header can have address extension by a 4th
    or a 5th and 6th address, but never both. Drop such
    frames in 802.11 -> 802.3 conversion along with any
    frames that have the wrong extension.

    Reviewed-by: Javier Cardona <javier@cozybit.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
    ---
    net/wireless/util.c | 11 ++++++-----
    1 file changed, 6 insertions(+), 5 deletions(-)

    diff --git a/net/wireless/util.c b/net/wireless/util.c
    index 6f13299..b3aeac4 100644
    --- a/net/wireless/util.c
    +++ b/net/wireless/util.c
    @@ -293,18 +293,15 @@ EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
    static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
    {
    int ae = meshhdr->flags & MESH_FLAGS_AE;
    - /* 7.1.3.5a.2 */
    + /* 802.11-2012, 8.2.4.7.3 */
    switch (ae) {
    + default:
    case 0:
    return 6;
    case MESH_FLAGS_AE_A4:
    return 12;
    case MESH_FLAGS_AE_A5_A6:
    return 18;
    - case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):
    - return 24;
    - default:
    - return 6;
    }
    }

    @@ -354,6 +351,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
    /* make sure meshdr->flags is on the linear part */
    if (!pskb_may_pull(skb, hdrlen + 1))
    return -1;
    + if (meshdr->flags & MESH_FLAGS_AE_A4)
    + return -1;
    if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
    skb_copy_bits(skb, hdrlen +
    offsetof(struct ieee80211s_hdr, eaddr1),
    @@ -378,6 +377,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
    /* make sure meshdr->flags is on the linear part */
    if (!pskb_may_pull(skb, hdrlen + 1))
    return -1;
    + if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
    + return -1;
    if (meshdr->flags & MESH_FLAGS_AE_A4)
    skb_copy_bits(skb, hdrlen +
    offsetof(struct ieee80211s_hdr, eaddr1),
    --
    1.7.9.5


    \
     
     \ /
      Last update: 2012-12-13 15:21    [W:4.137 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site