lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mac80211: mesh: fix two small problems

Browse Source 
1) there's a spin_lock() that needs to be spin_lock_bh()
2) action frames of size 24 might cause an out-of-bounds
   memory access (for the 25th byte only, so no big deal)

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Johannes Berg
2009-07-10 11:39:26 +02:00
committed by John W. Linville
parent ec3f149017
commit a43816df2a
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
net/mac80211/mesh.c
View File

@@ -685,9 +685,12 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
fc = le16_to_cpu(mgmt->frame_control); fc = le16_to_cpu(mgmt->frame_control);
switch (fc & IEEE80211_FCTL_STYPE) { switch (fc & IEEE80211_FCTL_STYPE) {
case IEEE80211_STYPE_ACTION:
if (skb->len < IEEE80211_MIN_ACTION_SIZE)
return RX_DROP_MONITOR;
/* fall through */
case IEEE80211_STYPE_PROBE_RESP: case IEEE80211_STYPE_PROBE_RESP:
case IEEE80211_STYPE_BEACON: case IEEE80211_STYPE_BEACON:
case IEEE80211_STYPE_ACTION:
skb_queue_tail(&ifmsh->skb_queue, skb); skb_queue_tail(&ifmsh->skb_queue, skb);
queue_work(local->hw.workqueue, &ifmsh->work); queue_work(local->hw.workqueue, &ifmsh->work);
return RX_QUEUED; return RX_QUEUED;

6
net/mac80211/mesh_hwmp.c
View File

@@ -686,11 +686,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
u8 ttl, dst_flags; u8 ttl, dst_flags;
u32 lifetime; u32 lifetime;
spin_lock(&ifmsh->mesh_preq_queue_lock); spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
if (!ifmsh->preq_queue_len || if (!ifmsh->preq_queue_len ||
time_before(jiffies, ifmsh->last_preq + time_before(jiffies, ifmsh->last_preq +
min_preq_int_jiff(sdata))) { min_preq_int_jiff(sdata))) {
spin_unlock(&ifmsh->mesh_preq_queue_lock); spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
return; return;
} }
@@ -698,7 +698,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
struct mesh_preq_queue, list); struct mesh_preq_queue, list);
list_del(&preq_node->list); list_del(&preq_node->list);
--ifmsh->preq_queue_len; --ifmsh->preq_queue_len;
spin_unlock(&ifmsh->mesh_preq_queue_lock); spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
rcu_read_lock(); rcu_read_lock();
mpath = mesh_path_lookup(preq_node->dst, sdata); mpath = mesh_path_lookup(preq_node->dst, sdata);