diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2014-01-23 19:20:29 +0400 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2014-02-05 00:58:07 +0400 |
| commit | d8ca16db6bb23d03fcb794df44bae64ae976f27c (patch) | |
| tree | f577a829374c0f9daba8bf70e1ea3d6ac107089c /include/linux/ieee80211.h | |
| parent | ae811e21df28deb4c2adab0a47fc3da4f56d777b (diff) | |
| download | linux-d8ca16db6bb23d03fcb794df44bae64ae976f27c.tar.xz | |
mac80211: add length check in ieee80211_is_robust_mgmt_frame()
A few places weren't checking that the frame passed to the
function actually has enough data even though the function
clearly documents it must have a payload byte. Make this
safer by changing the function to take an skb and checking
the length inside. The old version is preserved for now as
the rtl* drivers use it and don't have a correct skb.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'include/linux/ieee80211.h')
| -rw-r--r-- | include/linux/ieee80211.h | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index e526a8cecb70..923c478030a3 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -2192,10 +2192,10 @@ static inline u8 *ieee80211_get_DA(struct ieee80211_hdr *hdr) } /** - * ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame + * _ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame * @hdr: the frame (buffer must include at least the first octet of payload) */ -static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr) +static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr) { if (ieee80211_is_disassoc(hdr->frame_control) || ieee80211_is_deauth(hdr->frame_control)) @@ -2224,6 +2224,17 @@ static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr) } /** + * ieee80211_is_robust_mgmt_frame - check if skb contains a robust mgmt frame + * @skb: the skb containing the frame, length will be checked + */ +static inline bool ieee80211_is_robust_mgmt_frame(struct sk_buff *skb) +{ + if (skb->len < 25) + return false; + return _ieee80211_is_robust_mgmt_frame((void *)skb->data); +} + +/** * ieee80211_is_public_action - check if frame is a public action frame * @hdr: the frame * @len: length of the frame |