mac80211: validate TIM IE length (redux)
The TIM IE must not be shorter than 4 bytes, so verify that when parsing it and use the proper type. To ease that adjust struct ieee80211_tim_ie to have a virtual bitmap of size at least 1. Also check that the TIM IE is actually present before trying to parse it! Because other people may need the function, make it a static inline in ieee80211.h. (The original "mac80211: validate TIM IE length" was a minimal fix for 2.6.30. This purports to be the full, correct fix. -- JWL) Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
ba44cb7226
commit
e7ec86f54e
|
@ -540,7 +540,7 @@ struct ieee80211_tim_ie {
|
||||||
u8 dtim_period;
|
u8 dtim_period;
|
||||||
u8 bitmap_ctrl;
|
u8 bitmap_ctrl;
|
||||||
/* variable size: 1 - 251 bytes */
|
/* variable size: 1 - 251 bytes */
|
||||||
u8 virtual_map[0];
|
u8 virtual_map[1];
|
||||||
} __attribute__ ((packed));
|
} __attribute__ ((packed));
|
||||||
|
|
||||||
#define WLAN_SA_QUERY_TR_ID_LEN 16
|
#define WLAN_SA_QUERY_TR_ID_LEN 16
|
||||||
|
@ -1392,4 +1392,34 @@ static inline unsigned long ieee80211_tu_to_usec(unsigned long tu)
|
||||||
return 1024 * tu;
|
return 1024 * tu;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* ieee80211_check_tim - check if AID bit is set in TIM
|
||||||
|
* @tim: the TIM IE
|
||||||
|
* @tim_len: length of the TIM IE
|
||||||
|
* @aid: the AID to look for
|
||||||
|
*/
|
||||||
|
static inline bool ieee80211_check_tim(struct ieee80211_tim_ie *tim,
|
||||||
|
u8 tim_len, u16 aid)
|
||||||
|
{
|
||||||
|
u8 mask;
|
||||||
|
u8 index, indexn1, indexn2;
|
||||||
|
|
||||||
|
if (unlikely(!tim || tim_len < sizeof(*tim)))
|
||||||
|
return false;
|
||||||
|
|
||||||
|
aid &= 0x3fff;
|
||||||
|
index = aid / 8;
|
||||||
|
mask = 1 << (aid & 7);
|
||||||
|
|
||||||
|
indexn1 = tim->bitmap_ctrl & 0xfe;
|
||||||
|
indexn2 = tim_len + indexn1 - 4;
|
||||||
|
|
||||||
|
if (index < indexn1 || index > indexn2)
|
||||||
|
return false;
|
||||||
|
|
||||||
|
index -= indexn1;
|
||||||
|
|
||||||
|
return !!(tim->virtual_map[index] & mask);
|
||||||
|
}
|
||||||
|
|
||||||
#endif /* LINUX_IEEE80211_H */
|
#endif /* LINUX_IEEE80211_H */
|
||||||
|
|
|
@ -832,7 +832,7 @@ struct ieee802_11_elems {
|
||||||
u8 *fh_params;
|
u8 *fh_params;
|
||||||
u8 *ds_params;
|
u8 *ds_params;
|
||||||
u8 *cf_params;
|
u8 *cf_params;
|
||||||
u8 *tim;
|
struct ieee80211_tim_ie *tim;
|
||||||
u8 *ibss_params;
|
u8 *ibss_params;
|
||||||
u8 *challenge;
|
u8 *challenge;
|
||||||
u8 *wpa;
|
u8 *wpa;
|
||||||
|
|
|
@ -675,30 +675,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
|
|
||||||
{
|
|
||||||
u8 mask;
|
|
||||||
u8 index, indexn1, indexn2;
|
|
||||||
struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
|
|
||||||
|
|
||||||
if (unlikely(!tim || elems->tim_len < 4))
|
|
||||||
return false;
|
|
||||||
|
|
||||||
aid &= 0x3fff;
|
|
||||||
index = aid / 8;
|
|
||||||
mask = 1 << (aid & 7);
|
|
||||||
|
|
||||||
indexn1 = tim->bitmap_ctrl & 0xfe;
|
|
||||||
indexn2 = elems->tim_len + indexn1 - 4;
|
|
||||||
|
|
||||||
if (index < indexn1 || index > indexn2)
|
|
||||||
return false;
|
|
||||||
|
|
||||||
index -= indexn1;
|
|
||||||
|
|
||||||
return !!(tim->virtual_map[index] & mask);
|
|
||||||
}
|
|
||||||
|
|
||||||
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
|
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
|
||||||
u16 capab, bool erp_valid, u8 erp)
|
u16 capab, bool erp_valid, u8 erp)
|
||||||
{
|
{
|
||||||
|
@ -1806,7 +1782,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
|
||||||
care_about_ies, ncrc);
|
care_about_ies, ncrc);
|
||||||
|
|
||||||
if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
|
if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
|
||||||
directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);
|
directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
|
||||||
|
ifmgd->aid);
|
||||||
|
|
||||||
ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim));
|
ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim));
|
||||||
|
|
||||||
|
|
|
@ -588,8 +588,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
|
||||||
elems->cf_params_len = elen;
|
elems->cf_params_len = elen;
|
||||||
break;
|
break;
|
||||||
case WLAN_EID_TIM:
|
case WLAN_EID_TIM:
|
||||||
elems->tim = pos;
|
if (elen >= sizeof(struct ieee80211_tim_ie)) {
|
||||||
elems->tim_len = elen;
|
elems->tim = (void *)pos;
|
||||||
|
elems->tim_len = elen;
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
case WLAN_EID_IBSS_PARAMS:
|
case WLAN_EID_IBSS_PARAMS:
|
||||||
elems->ibss_params = pos;
|
elems->ibss_params = pos;
|
||||||
|
|
Loading…
Reference in a new issue