Return-path: Received: from mail-wg0-f42.google.com ([74.125.82.42]:43642 "EHLO mail-wg0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2992573Ab2JYUPN (ORCPT ); Thu, 25 Oct 2012 16:15:13 -0400 Received: by mail-wg0-f42.google.com with SMTP id fm10so50402wgb.1 for ; Thu, 25 Oct 2012 13:15:12 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <1351195011-30148-1-git-send-email-johannes@sipsolutions.net> References: <1351195011-30148-1-git-send-email-johannes@sipsolutions.net> From: Javier Cardona Date: Thu, 25 Oct 2012 13:14:52 -0700 Message-ID: (sfid-20121025_221518_310237_204FCF78) Subject: Re: [PATCH] wireless: drop invalid mesh address extension frames To: Johannes Berg Cc: linux-wireless@vger.kernel.org, Johannes Berg Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-wireless-owner@vger.kernel.org List-ID: Johannes, Thanks for removing those legacy formats. See inline: On Thu, Oct 25, 2012 at 12:56 PM, Johannes Berg wrote: > From: Johannes Berg > > The mesh header can have address extension by a 4th > or a 5th and 6th address, but never both. Drop such > frames in 802.11 -> 802.3 conversion. > > Cc: stable@vger.kernel.org > Signed-off-by: Johannes Berg > --- > net/wireless/util.c | 17 ++++++++++++----- > 1 file changed, 12 insertions(+), 5 deletions(-) > > diff --git a/net/wireless/util.c b/net/wireless/util.c > index ef35f4e..7296ec0 100644 > --- a/net/wireless/util.c > +++ b/net/wireless/util.c > @@ -312,18 +312,15 @@ EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb); > static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr) > { > int ae = meshhdr->flags & MESH_FLAGS_AE; > - /* 7.1.3.5a.2 */ > + /* IEEE 802.11 - 8.2.4.7.3 */ > switch (ae) { > + default: > case 0: > return 6; > case MESH_FLAGS_AE_A4: > return 12; > case MESH_FLAGS_AE_A5_A6: > return 18; > - case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6): > - return 24; > - default: > - return 6; > } > } > > @@ -373,6 +370,11 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr, > /* make sure meshdr->flags is on the linear part */ > if (!pskb_may_pull(skb, hdrlen + 1)) > return -1; > + /* reserved */ > + if ((meshdr->flags & MESH_FLAGS_AE) == > + (MESH_FLAGS_AE_A4 | > + MESH_FLAGS_AE_A5_A6)) > + return -1; You can filter more aggressively: If we are here we know that it is a unicast data frame (because FromDS == ToDS == 1). In that case, the only valid address extension modes are 0 or MESH_FLAGS_AE_A5_A6 (see Table 8-14). IOW, you could do: > + if ((meshdr->flags & MESH_FLAGS_AE_A4))) > + return -1 > if (meshdr->flags & MESH_FLAGS_AE_A5_A6) { > skb_copy_bits(skb, hdrlen + > offsetof(struct ieee80211s_hdr, eaddr1), > @@ -397,6 +399,11 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr, > /* make sure meshdr->flags is on the linear part */ > if (!pskb_may_pull(skb, hdrlen + 1)) > return -1; > + /* reserved */ > + if ((meshdr->flags & MESH_FLAGS_AE) == > + (MESH_FLAGS_AE_A4 | > + MESH_FLAGS_AE_A5_A6)) > + return -1; And a similar comment here: only valid address extension modes are 0 or MESH_FLAGS_AE_A4, i.e. > + if ((meshdr->flags & MESH_FLAGS_AE_A5_A6))) > + return -1 > if (meshdr->flags & MESH_FLAGS_AE_A4) > skb_copy_bits(skb, hdrlen + > offsetof(struct ieee80211s_hdr, eaddr1), > -- > 1.7.10.4 > Cheers, Javier -- Javier Cardona cozybit Inc. http://www.cozybit.com