Patch "mac80211: clear sequence/fragment number in QoS-null frames" has been added to the 3.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    mac80211: clear sequence/fragment number in QoS-null frames

to the 3.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mac80211-clear-sequence-fragment-number-in-qos-null-frames.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From 864a6040f395464003af8dd0d8ca86fed19866d4 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@xxxxxxxxx>
Date: Tue, 4 Mar 2014 13:46:53 +0100
Subject: mac80211: clear sequence/fragment number in QoS-null frames

From: Johannes Berg <johannes.berg@xxxxxxxxx>

commit 864a6040f395464003af8dd0d8ca86fed19866d4 upstream.

Avoid leaking data by sending uninitialized memory and setting an
invalid (non-zero) fragment number (the sequence number is ignored
anyway) by setting the seq_ctrl field to zero.

Fixes: 3f52b7e328c5 ("mac80211: mesh power save basics")
Fixes: ce662b44ce22 ("mac80211: send (QoS) Null if no buffered frames")
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx>
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

---
 net/mac80211/mesh_ps.c  |    1 +
 net/mac80211/sta_info.c |    1 +
 2 files changed, 2 insertions(+)

--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -36,6 +36,7 @@ static struct sk_buff *mps_qos_null_get(
 				      sdata->vif.addr);
 	nullfunc->frame_control = fc;
 	nullfunc->duration_id = 0;
+	nullfunc->seq_ctrl = 0;
 	/* no address resolution for this frame -> set addr 1 immediately */
 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
 	memset(skb_put(skb, 2), 0, 2); /* append QoS control field */
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1114,6 +1114,7 @@ static void ieee80211_send_null_response
 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
 	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
+	nullfunc->seq_ctrl = 0;
 
 	skb->priority = tid;
 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);


Patches currently in stable-queue which might be from johannes.berg@xxxxxxxxx are

queue-3.10/mac80211-clear-sequence-fragment-number-in-qos-null-frames.patch
queue-3.10/mac80211-fix-association-to-20-40-mhz-vht-networks.patch
queue-3.10/mac80211-send-control-port-protocol-frames-to-the-vo-queue.patch
queue-3.10/iwlwifi-dvm-clear-iwl_sta_ucode_inprogress-when-assoc-fails.patch
queue-3.10/iwlwifi-fix-tx-status-for-aggregated-packets.patch
queue-3.10/mac80211-fix-ap-powersave-tx-vs.-wakeup-race.patch
queue-3.10/mac80211-don-t-validate-unchanged-ap-bandwidth-while-tracking.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]