Commit a43816df authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville
Browse files

mac80211: mesh: fix two small problems 



1) there's a spin_lock() that needs to be spin_lock_bh()
2) action frames of size 24 might cause an out-of-bounds
   memory access (for the 25th byte only, so no big deal)

Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent ec3f1490

net/mac80211/mesh.c

+4 −1
Original line number Diff line number Diff line
@@ -685,9 +685,12 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb) 
	fc = le16_to_cpu(mgmt->frame_control);



	switch (fc & IEEE80211_FCTL_STYPE) {

	case IEEE80211_STYPE_ACTION:

		if (skb->len < IEEE80211_MIN_ACTION_SIZE)

			return RX_DROP_MONITOR;

		/* fall through */

	case IEEE80211_STYPE_PROBE_RESP:

	case IEEE80211_STYPE_BEACON:

	case IEEE80211_STYPE_ACTION:

		skb_queue_tail(&ifmsh->skb_queue, skb);

		queue_work(local->hw.workqueue, &ifmsh->work);

		return RX_QUEUED;

net/mac80211/mesh_hwmp.c

+3 −3
Original line number Diff line number Diff line
@@ -686,11 +686,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata) 
	u8 ttl, dst_flags;

	u32 lifetime;



	spin_lock(&ifmsh->mesh_preq_queue_lock);

	spin_lock_bh(&ifmsh->mesh_preq_queue_lock);

	if (!ifmsh->preq_queue_len ||

		time_before(jiffies, ifmsh->last_preq +

				min_preq_int_jiff(sdata))) {

		spin_unlock(&ifmsh->mesh_preq_queue_lock);

		spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);

		return;

	}
@@ -698,7 +698,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata) 
			struct mesh_preq_queue, list);

	list_del(&preq_node->list);

	--ifmsh->preq_queue_len;

	spin_unlock(&ifmsh->mesh_preq_queue_lock);

	spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);



	rcu_read_lock();

	mpath = mesh_path_lookup(preq_node->dst, sdata);

CRA Git | Maintained and supported by SUSTech CRA and CCSE