aboutsummaryrefslogtreecommitdiffstats
path: root/net/mac80211/sta_info.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2014-03-04 07:46:53 -0500
committerJohannes Berg <johannes.berg@intel.com>2014-03-05 09:49:54 -0500
commit864a6040f395464003af8dd0d8ca86fed19866d4 (patch)
tree1cfbdad9ad7df012fbddac170402795f2c99ef12 /net/mac80211/sta_info.c
parentbc00a91d627026f08abf69bf5d0015499dd30c2a (diff)
mac80211: clear sequence/fragment number in QoS-null frames
Avoid leaking data by sending uninitialized memory and setting an invalid (non-zero) fragment number (the sequence number is ignored anyway) by setting the seq_ctrl field to zero. Cc: stable@vger.kernel.org Fixes: 3f52b7e328c5 ("mac80211: mesh power save basics") Fixes: ce662b44ce22 ("mac80211: send (QoS) Null if no buffered frames") Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211/sta_info.c')
-rw-r--r--net/mac80211/sta_info.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a023b432143b..137a192e64bc 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1206,6 +1206,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
1206 memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN); 1206 memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
1207 memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN); 1207 memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1208 memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN); 1208 memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
1209 nullfunc->seq_ctrl = 0;
1209 1210
1210 skb->priority = tid; 1211 skb->priority = tid;
1211 skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]); 1212 skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);