aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--include/linux/ieee80211.h32
-rw-r--r--net/mac80211/ieee80211_i.h2
-rw-r--r--net/mac80211/mlme.c27
-rw-r--r--net/mac80211/util.c6
4 files changed, 38 insertions, 29 deletions
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 53563d53b5ad..c52e7fba4e40 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -540,7 +540,7 @@ struct ieee80211_tim_ie {
540 u8 dtim_period; 540 u8 dtim_period;
541 u8 bitmap_ctrl; 541 u8 bitmap_ctrl;
542 /* variable size: 1 - 251 bytes */ 542 /* variable size: 1 - 251 bytes */
543 u8 virtual_map[0]; 543 u8 virtual_map[1];
544} __attribute__ ((packed)); 544} __attribute__ ((packed));
545 545
546#define WLAN_SA_QUERY_TR_ID_LEN 16 546#define WLAN_SA_QUERY_TR_ID_LEN 16
@@ -1392,4 +1392,34 @@ static inline unsigned long ieee80211_tu_to_usec(unsigned long tu)
1392 return 1024 * tu; 1392 return 1024 * tu;
1393} 1393}
1394 1394
1395/**
1396 * ieee80211_check_tim - check if AID bit is set in TIM
1397 * @tim: the TIM IE
1398 * @tim_len: length of the TIM IE
1399 * @aid: the AID to look for
1400 */
1401static inline bool ieee80211_check_tim(struct ieee80211_tim_ie *tim,
1402 u8 tim_len, u16 aid)
1403{
1404 u8 mask;
1405 u8 index, indexn1, indexn2;
1406
1407 if (unlikely(!tim || tim_len < sizeof(*tim)))
1408 return false;
1409
1410 aid &= 0x3fff;
1411 index = aid / 8;
1412 mask = 1 << (aid & 7);
1413
1414 indexn1 = tim->bitmap_ctrl & 0xfe;
1415 indexn2 = tim_len + indexn1 - 4;
1416
1417 if (index < indexn1 || index > indexn2)
1418 return false;
1419
1420 index -= indexn1;
1421
1422 return !!(tim->virtual_map[index] & mask);
1423}
1424
1395#endif /* LINUX_IEEE80211_H */ 1425#endif /* LINUX_IEEE80211_H */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index dba78d89a10c..1579bc92c88d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -832,7 +832,7 @@ struct ieee802_11_elems {
832 u8 *fh_params; 832 u8 *fh_params;
833 u8 *ds_params; 833 u8 *ds_params;
834 u8 *cf_params; 834 u8 *cf_params;
835 u8 *tim; 835 struct ieee80211_tim_ie *tim;
836 u8 *ibss_params; 836 u8 *ibss_params;
837 u8 *challenge; 837 u8 *challenge;
838 u8 *wpa; 838 u8 *wpa;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 428742d7f440..1b0b7aa387ee 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -675,30 +675,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
675 } 675 }
676} 676}
677 677
678static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
679{
680 u8 mask;
681 u8 index, indexn1, indexn2;
682 struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
683
684 if (unlikely(!tim || elems->tim_len < 4))
685 return false;
686
687 aid &= 0x3fff;
688 index = aid / 8;
689 mask = 1 << (aid & 7);
690
691 indexn1 = tim->bitmap_ctrl & 0xfe;
692 indexn2 = elems->tim_len + indexn1 - 4;
693
694 if (index < indexn1 || index > indexn2)
695 return false;
696
697 index -= indexn1;
698
699 return !!(tim->virtual_map[index] & mask);
700}
701
702static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata, 678static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
703 u16 capab, bool erp_valid, u8 erp) 679 u16 capab, bool erp_valid, u8 erp)
704{ 680{
@@ -1806,7 +1782,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
1806 care_about_ies, ncrc); 1782 care_about_ies, ncrc);
1807 1783
1808 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) 1784 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1809 directed_tim = ieee80211_check_tim(&elems, ifmgd->aid); 1785 directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
1786 ifmgd->aid);
1810 1787
1811 ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim)); 1788 ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim));
1812 1789
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 11244212f41d..61876eb50b49 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -588,8 +588,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
588 elems->cf_params_len = elen; 588 elems->cf_params_len = elen;
589 break; 589 break;
590 case WLAN_EID_TIM: 590 case WLAN_EID_TIM:
591 elems->tim = pos; 591 if (elen >= sizeof(struct ieee80211_tim_ie)) {
592 elems->tim_len = elen; 592 elems->tim = (void *)pos;
593 elems->tim_len = elen;
594 }
593 break; 595 break;
594 case WLAN_EID_IBSS_PARAMS: 596 case WLAN_EID_IBSS_PARAMS:
595 elems->ibss_params = pos; 597 elems->ibss_params = pos;