mac80211: validate TIM IE length (redux)

The TIM IE must not be shorter than 4 bytes, so verify that
when parsing it and use the proper type. To ease that adjust
struct ieee80211_tim_ie to have a virtual bitmap of size
at least 1.

Also check that the TIM IE is actually present before trying
to parse it!

Because other people may need the function, make it a static
inline in ieee80211.h.

(The original "mac80211: validate TIM IE length" was a minimal fix for
2.6.30.  This purports to be the full, correct fix. -- JWL)

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 2 insertions, 25 deletions

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 428742d7f440..1b0b7aa387ee 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -675,30 +675,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         }
 }
 
-static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
-{
-        u8 mask;
-        u8 index, indexn1, indexn2;
-        struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
-
-        if (unlikely(!tim || elems->tim_len < 4))
-                return false;
-
-        aid &= 0x3fff;
-        index = aid / 8;
-        mask  = 1 << (aid & 7);
-
-        indexn1 = tim->bitmap_ctrl & 0xfe;
-        indexn2 = elems->tim_len + indexn1 - 4;
-
-        if (index < indexn1 || index > indexn2)
-                return false;
-
-        index -= indexn1;
-
-        return !!(tim->virtual_map[index] & mask);
-}
-
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                            u16 capab, bool erp_valid, u8 erp)
 {
@@ -1806,7 +1782,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                           care_about_ies, ncrc);
 
         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);
+                directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
+                                                   ifmgd->aid);
 
         ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim));