summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJohannes Berg <johannes@sipsolutions.net>2009-04-18 17:33:24 +0200
committerJohn W. Linville <linville@tuxdriver.com>2009-04-22 16:57:18 -0400
commite7ec86f54e519e8e86f1cf328db13263f3ef8bd4 (patch)
tree2b0a66930abf4ac710cc15120195c9259a0fcaba /net
parentba44cb7226afd4e19308c1d8a90e8b7c566c0d8b (diff)
downloadlinux-e7ec86f54e519e8e86f1cf328db13263f3ef8bd4.tar.gz
linux-e7ec86f54e519e8e86f1cf328db13263f3ef8bd4.tar.bz2
linux-e7ec86f54e519e8e86f1cf328db13263f3ef8bd4.zip
mac80211: validate TIM IE length (redux)
The TIM IE must not be shorter than 4 bytes, so verify that when parsing it and use the proper type. To ease that adjust struct ieee80211_tim_ie to have a virtual bitmap of size at least 1. Also check that the TIM IE is actually present before trying to parse it! Because other people may need the function, make it a static inline in ieee80211.h. (The original "mac80211: validate TIM IE length" was a minimal fix for 2.6.30. This purports to be the full, correct fix. -- JWL) Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net')
-rw-r--r--net/mac80211/ieee80211_i.h2
-rw-r--r--net/mac80211/mlme.c27
-rw-r--r--net/mac80211/util.c6
3 files changed, 7 insertions, 28 deletions
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index dba78d89a10c..1579bc92c88d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -832,7 +832,7 @@ struct ieee802_11_elems {
u8 *fh_params;
u8 *ds_params;
u8 *cf_params;
- u8 *tim;
+ struct ieee80211_tim_ie *tim;
u8 *ibss_params;
u8 *challenge;
u8 *wpa;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 428742d7f440..1b0b7aa387ee 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -675,30 +675,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
}
}
-static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
-{
- u8 mask;
- u8 index, indexn1, indexn2;
- struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
-
- if (unlikely(!tim || elems->tim_len < 4))
- return false;
-
- aid &= 0x3fff;
- index = aid / 8;
- mask = 1 << (aid & 7);
-
- indexn1 = tim->bitmap_ctrl & 0xfe;
- indexn2 = elems->tim_len + indexn1 - 4;
-
- if (index < indexn1 || index > indexn2)
- return false;
-
- index -= indexn1;
-
- return !!(tim->virtual_map[index] & mask);
-}
-
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
u16 capab, bool erp_valid, u8 erp)
{
@@ -1806,7 +1782,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
care_about_ies, ncrc);
if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
- directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);
+ directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
+ ifmgd->aid);
ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim));
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 11244212f41d..61876eb50b49 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -588,8 +588,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
elems->cf_params_len = elen;
break;
case WLAN_EID_TIM:
- elems->tim = pos;
- elems->tim_len = elen;
+ if (elen >= sizeof(struct ieee80211_tim_ie)) {
+ elems->tim = (void *)pos;
+ elems->tim_len = elen;
+ }
break;
case WLAN_EID_IBSS_PARAMS:
elems->ibss_params = pos;