forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mac80211: add length check in ieee80211_is_robust_mgmt_frame()

Browse source 
A few places weren't checking that the frame passed to the
function actually has enough data even though the function
clearly documents it must have a payload byte. Make this
safer by changing the function to take an skb and checking
the length inside. The old version is preserved for now as
the rtl* drivers use it and don't have a correct skb.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Johannes Berg 2014-01-23 16:20:29 +01:00
parent ae811e21df
commit d8ca16db6b
8 changed files with 28 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

13
net/mac80211/rx.c
View file

@ -599,10 +599,10 @@ static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
if (is_multicast_ether_addr(hdr->addr1))
return 0;
return ieee80211_is_robust_mgmt_frame(hdr);
return ieee80211_is_robust_mgmt_frame(skb);
}
@ -610,10 +610,10 @@ static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
if (!is_multicast_ether_addr(hdr->addr1))
return 0;
return ieee80211_is_robust_mgmt_frame(hdr);
return ieee80211_is_robust_mgmt_frame(skb);
}
@ -626,7 +626,7 @@ static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
return -1;
if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
if (!ieee80211_is_robust_mgmt_frame(skb))
return -1; /* not a robust management frame */
mmie = (struct ieee80211_mmie *)
@ -1845,8 +1845,7 @@ static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
* having configured keys.
*/
if (unlikely(ieee80211_is_action(fc) && !rx->key &&
ieee80211_is_robust_mgmt_frame(
(struct ieee80211_hdr *) rx->skb->data)))
ieee80211_is_robust_mgmt_frame(rx->skb)))
return -EACCES;
}