summaryrefslogtreecommitdiffstats
path: root/net/mac80211/mesh.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes@sipsolutions.net>2009-07-10 11:39:26 +0200
committerJohn W. Linville <linville@tuxdriver.com>2009-07-24 15:05:10 -0400
commita43816df2a1a61effcb701037bdf63621d066182 (patch)
tree33346bbbb1621dfc7966c2f4ad8b1a76f4145d18 /net/mac80211/mesh.c
parentec3f149017ef3fd21343b1dcec3589eec6ba5dd5 (diff)
downloadop-kernel-dev-a43816df2a1a61effcb701037bdf63621d066182.zip
op-kernel-dev-a43816df2a1a61effcb701037bdf63621d066182.tar.gz
mac80211: mesh: fix two small problems
1) there's a spin_lock() that needs to be spin_lock_bh() 2) action frames of size 24 might cause an out-of-bounds memory access (for the 25th byte only, so no big deal) Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/mesh.c')
-rw-r--r--net/mac80211/mesh.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 542ea02..8a97b14 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -685,9 +685,12 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
fc = le16_to_cpu(mgmt->frame_control);
switch (fc & IEEE80211_FCTL_STYPE) {
+ case IEEE80211_STYPE_ACTION:
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+ return RX_DROP_MONITOR;
+ /* fall through */
case IEEE80211_STYPE_PROBE_RESP:
case IEEE80211_STYPE_BEACON:
- case IEEE80211_STYPE_ACTION:
skb_queue_tail(&ifmsh->skb_queue, skb);
queue_work(local->hw.workqueue, &ifmsh->work);
return RX_QUEUED;
OpenPOWER on IntegriCloud