summaryrefslogtreecommitdiffstats
path: root/net/wireless
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2017-04-27 09:13:38 +0200
committerJohannes Berg <johannes.berg@intel.com>2017-05-08 11:24:34 +0200
commit4954601f821bb5afd4dd59b57bf801adf4924bbd (patch)
tree1168c860b5943f8c781feb85487ca7993dd2dfd3 /net/wireless
parentf8860ce836f2d502b07ef99559707fe55d90f5bc (diff)
downloadlinux-4954601f821bb5afd4dd59b57bf801adf4924bbd.tar.gz
linux-4954601f821bb5afd4dd59b57bf801adf4924bbd.tar.bz2
linux-4954601f821bb5afd4dd59b57bf801adf4924bbd.zip
nl80211: correctly validate MU-MIMO groups
Since groups 0 and 63 are invalid, we should check for those bits. Note that the 802.11 spec specifies the *bit* order, but the CPU doesn't care about bit order since it can't address bits, so it's always treating BIT(0) as the lowest bit within a byte. Reported-by: Jan Fuchs <jan.fuchs@lancom.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
-rw-r--r--net/wireless/nl80211.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 570fc95dc507..c3bc9da30cff 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2764,8 +2764,8 @@ static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
/* bits 0 and 63 are reserved and must be zero */
- if ((mumimo_groups[0] & BIT(7)) ||
- (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(0)))
+ if ((mumimo_groups[0] & BIT(0)) ||
+ (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
return -EINVAL;
params->vht_mumimo_groups = mumimo_groups;