2017-02-03 13:52:45

by Sven Eckelmann

Subject: [PATCH] mac80211: Fix adding of mesh vendor IEs

From: Thorsten Horstmann <[email protected]>

The function ieee80211_ie_split_vendor doesn't return 0 on errors. Instead
it returns any offset < ielen when WLAN_EID_VENDOR_SPECIFIC is found. The
return value in mesh_add_vendor_ies must therefore be checked against
ifmsh->ie_len and not 0. Otherwise all ifmsh->ie starting with
WLAN_EID_VENDOR_SPECIFIC will be rejected.

Fixes: 082ebb0c258d ("mac80211: fix mesh beacon format")
Signed-off-by: Thorsten Horstmann <[email protected]>
Signed-off-by: Mathias Kretschmer <[email protected]>
Signed-off-by: Simon Wunderlich <[email protected]>
[[email protected]: Add commit message]
Signed-off-by: Sven Eckelmann <[email protected]>
---
net/mac80211/mesh.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index d36c7f4c0c7e..6e7b6a07b7d5 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -335,7 +335,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
/* fast-forward to vendor IEs */
offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);

- if (offset) {
+ if (offset < ifmsh->ie_len) {
len = ifmsh->ie_len - offset;
data = ifmsh->ie + offset;
if (skb_tailroom(skb) < len)
--
2.11.0

2017-02-06 06:57:13

by Johannes Berg

Subject: Re: [PATCH] mac80211: Fix adding of mesh vendor IEs

On Fri, 2017-02-03 at 14:38 +0100, Sven Eckelmann wrote:
> From: Thorsten Horstmann <[email protected]>
>
> The function ieee80211_ie_split_vendor doesn't return 0 on errors.
> Instead
> it returns any offset < ielen when WLAN_EID_VENDOR_SPECIFIC is found.
> The
> return value in mesh_add_vendor_ies must therefore be checked against
> ifmsh->ie_len and not 0. Otherwise all ifmsh->ie starting with
> WLAN_EID_VENDOR_SPECIFIC will be rejected.
>
> Fixes: 082ebb0c258d ("mac80211: fix mesh beacon format")
> Signed-off-by: Thorsten Horstmann <[email protected]>
> Signed-off-by: Mathias Kretschmer <[email protected].
> de>
> Signed-off-by: Simon Wunderlich <[email protected]>
> [[email protected]: Add commit message]
> Signed-off-by: Sven Eckelmann <[email protected]>

I'm impressed by how many people signed this off without thinking about
a commit message ... :)

Anyway, applied.

johannes