mac80211: clear sequence/fragment number in QoS-null frames (864a6040) · Commits · 戴 / test

Avoid leaking data by sending uninitialized memory and setting an invalid (non-zero) fragment number (the sequence number is ignored anyway) by setting the seq_ctrl field to zero. Cc: stable@vger.kernel.org Fixes: ("mac80211: mesh power save basics") Fixes: ("mac80211: send (QoS) Null if no buffered frames") Reviewed-by:

Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by:

Johannes Berg <johannes.berg@intel.com>

net/mac80211/mesh_ps.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -36,6 +36,7 @@ static struct sk_buff mps_qos_null_get(struct sta_info sta)
		sdata->vif.addr);
		nullfunc->frame_control = fc;
		nullfunc->duration_id = 0;
		nullfunc->seq_ctrl = 0;
		/* no address resolution for this frame -> set addr 1 immediately */
		memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
		memset(skb_put(skb, 2), 0, 2); /* append QoS control field */

net/mac80211/sta_info.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1206,6 +1206,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
		memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
		memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
		memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
		nullfunc->seq_ctrl = 0;

		skb->priority = tid;
		skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);

Admin message