On Thu, Oct 25, 2012 at 1:19 PM, Johannes Berg
<johannes@xxxxxxxxxxxxxxxx> wrote:
> From: Johannes Berg <johannes.berg@xxxxxxxxx>
>
> The mesh header can have address extension by a 4th
> or a 5th and 6th address, but never both. Drop such
> frames in 802.11 -> 802.3 conversion along with any
> frames that have the wrong extension.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Reviewed-by: Javier Cardona <javier@xxxxxxxxxxx>
> ---
> net/wireless/util.c | 11 ++++++-----
> 1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/net/wireless/util.c b/net/wireless/util.c
> index ef35f4e..387d6dc 100644
> --- a/net/wireless/util.c
> +++ b/net/wireless/util.c
> @@ -312,18 +312,15 @@ EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
> static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
> {
> int ae = meshhdr->flags & MESH_FLAGS_AE;
> - /* 7.1.3.5a.2 */
> + /* IEEE 802.11 - 8.2.4.7.3 */
> switch (ae) {
> + default:
> case 0:
> return 6;
> case MESH_FLAGS_AE_A4:
> return 12;
> case MESH_FLAGS_AE_A5_A6:
> return 18;
> - case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):
> - return 24;
> - default:
> - return 6;
> }
> }
>
> @@ -373,6 +370,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
> /* make sure meshdr->flags is on the linear part */
> if (!pskb_may_pull(skb, hdrlen + 1))
> return -1;
> + if (meshdr->flags & MESH_FLAGS_AE_A4)
> + return -1;
> if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
> skb_copy_bits(skb, hdrlen +
> offsetof(struct ieee80211s_hdr, eaddr1),
> @@ -397,6 +396,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
> /* make sure meshdr->flags is on the linear part */
> if (!pskb_may_pull(skb, hdrlen + 1))
> return -1;
> + if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
> + return -1;
> if (meshdr->flags & MESH_FLAGS_AE_A4)
> skb_copy_bits(skb, hdrlen +
> offsetof(struct ieee80211s_hdr, eaddr1),
> --
> 1.7.10.4
>
--
Javier Cardona
cozybit Inc.
http://www.cozybit.com
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
