diff options
author | Johannes Berg <johannes@sipsolutions.net> | 2009-04-18 11:33:24 -0400 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2009-04-22 16:57:18 -0400 |
commit | e7ec86f54e519e8e86f1cf328db13263f3ef8bd4 (patch) | |
tree | 2b0a66930abf4ac710cc15120195c9259a0fcaba /net | |
parent | ba44cb7226afd4e19308c1d8a90e8b7c566c0d8b (diff) |
mac80211: validate TIM IE length (redux)
The TIM IE must not be shorter than 4 bytes, so verify that
when parsing it and use the proper type. To ease that adjust
struct ieee80211_tim_ie to have a virtual bitmap of size
at least 1.
Also check that the TIM IE is actually present before trying
to parse it!
Because other people may need the function, make it a static
inline in ieee80211.h.
(The original "mac80211: validate TIM IE length" was a minimal fix for
2.6.30. This purports to be the full, correct fix. -- JWL)
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net')
-rw-r--r-- | net/mac80211/ieee80211_i.h | 2 | ||||
-rw-r--r-- | net/mac80211/mlme.c | 27 | ||||
-rw-r--r-- | net/mac80211/util.c | 6 |
3 files changed, 7 insertions, 28 deletions
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index dba78d89a10c..1579bc92c88d 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h | |||
@@ -832,7 +832,7 @@ struct ieee802_11_elems { | |||
832 | u8 *fh_params; | 832 | u8 *fh_params; |
833 | u8 *ds_params; | 833 | u8 *ds_params; |
834 | u8 *cf_params; | 834 | u8 *cf_params; |
835 | u8 *tim; | 835 | struct ieee80211_tim_ie *tim; |
836 | u8 *ibss_params; | 836 | u8 *ibss_params; |
837 | u8 *challenge; | 837 | u8 *challenge; |
838 | u8 *wpa; | 838 | u8 *wpa; |
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 428742d7f440..1b0b7aa387ee 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c | |||
@@ -675,30 +675,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local, | |||
675 | } | 675 | } |
676 | } | 676 | } |
677 | 677 | ||
678 | static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid) | ||
679 | { | ||
680 | u8 mask; | ||
681 | u8 index, indexn1, indexn2; | ||
682 | struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim; | ||
683 | |||
684 | if (unlikely(!tim || elems->tim_len < 4)) | ||
685 | return false; | ||
686 | |||
687 | aid &= 0x3fff; | ||
688 | index = aid / 8; | ||
689 | mask = 1 << (aid & 7); | ||
690 | |||
691 | indexn1 = tim->bitmap_ctrl & 0xfe; | ||
692 | indexn2 = elems->tim_len + indexn1 - 4; | ||
693 | |||
694 | if (index < indexn1 || index > indexn2) | ||
695 | return false; | ||
696 | |||
697 | index -= indexn1; | ||
698 | |||
699 | return !!(tim->virtual_map[index] & mask); | ||
700 | } | ||
701 | |||
702 | static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata, | 678 | static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata, |
703 | u16 capab, bool erp_valid, u8 erp) | 679 | u16 capab, bool erp_valid, u8 erp) |
704 | { | 680 | { |
@@ -1806,7 +1782,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, | |||
1806 | care_about_ies, ncrc); | 1782 | care_about_ies, ncrc); |
1807 | 1783 | ||
1808 | if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) | 1784 | if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) |
1809 | directed_tim = ieee80211_check_tim(&elems, ifmgd->aid); | 1785 | directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len, |
1786 | ifmgd->aid); | ||
1810 | 1787 | ||
1811 | ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim)); | 1788 | ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim)); |
1812 | 1789 | ||
diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 11244212f41d..61876eb50b49 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c | |||
@@ -588,8 +588,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, | |||
588 | elems->cf_params_len = elen; | 588 | elems->cf_params_len = elen; |
589 | break; | 589 | break; |
590 | case WLAN_EID_TIM: | 590 | case WLAN_EID_TIM: |
591 | elems->tim = pos; | 591 | if (elen >= sizeof(struct ieee80211_tim_ie)) { |
592 | elems->tim_len = elen; | 592 | elems->tim = (void *)pos; |
593 | elems->tim_len = elen; | ||
594 | } | ||
593 | break; | 595 | break; |
594 | case WLAN_EID_IBSS_PARAMS: | 596 | case WLAN_EID_IBSS_PARAMS: |
595 | elems->ibss_params = pos; | 597 | elems->ibss_params = pos; |