mac80211: validate TIM IE length (redux)

The TIM IE must not be shorter than 4 bytes, so verify that
when parsing it and use the proper type. To ease that adjust
struct ieee80211_tim_ie to have a virtual bitmap of size
at least 1.

Also check that the TIM IE is actually present before trying
to parse it!

Because other people may need the function, make it a static
inline in ieee80211.h.

(The original "mac80211: validate TIM IE length" was a minimal fix for
2.6.30.  This purports to be the full, correct fix. -- JWL)

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 53563d53b5ad1edbf46d7cae34421736a235f5b1..c52e7fba4e4016a11d33c4d05d52c62f2bd86bf8 100644 (file)
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -540,7 +540,7 @@ struct ieee80211_tim_ie {
        u8 dtim_period;
        u8 bitmap_ctrl;
        /* variable size: 1 - 251 bytes */
-       u8 virtual_map[0];
+       u8 virtual_map[1];
 } __attribute__ ((packed));
 
 #define WLAN_SA_QUERY_TR_ID_LEN 16
@@ -1392,4 +1392,34 @@ static inline unsigned long ieee80211_tu_to_usec(unsigned long tu)
        return 1024 * tu;
 }
 
+/**
+ * ieee80211_check_tim - check if AID bit is set in TIM
+ * @tim: the TIM IE
+ * @tim_len: length of the TIM IE
+ * @aid: the AID to look for
+ */
+static inline bool ieee80211_check_tim(struct ieee80211_tim_ie *tim,
+                                      u8 tim_len, u16 aid)
+{
+       u8 mask;
+       u8 index, indexn1, indexn2;
+
+       if (unlikely(!tim || tim_len < sizeof(*tim)))
+               return false;
+
+       aid &= 0x3fff;
+       index = aid / 8;
+       mask  = 1 << (aid & 7);
+
+       indexn1 = tim->bitmap_ctrl & 0xfe;
+       indexn2 = tim_len + indexn1 - 4;
+
+       if (index < indexn1 || index > indexn2)
+               return false;
+
+       index -= indexn1;
+
+       return !!(tim->virtual_map[index] & mask);
+}
+
 #endif /* LINUX_IEEE80211_H */

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index dba78d89a10c95953b97ceb98f8a804d6fd650a0..1579bc92c88df6742f04e65e7205fadf9835de51 100644 (file)
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -832,7 +832,7 @@ struct ieee802_11_elems {
        u8 *fh_params;
        u8 *ds_params;
        u8 *cf_params;
-       u8 *tim;
+       struct ieee80211_tim_ie *tim;
        u8 *ibss_params;
        u8 *challenge;
        u8 *wpa;

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 428742d7f440503cfb1cda9a0d4658a5796ae04a..1b0b7aa387ee7092275cc9fe753c0ac5b64dd8bb 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -675,30 +675,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
        }
 }
 
-static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
-{
-       u8 mask;
-       u8 index, indexn1, indexn2;
-       struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
-
-       if (unlikely(!tim || elems->tim_len < 4))
-               return false;
-
-       aid &= 0x3fff;
-       index = aid / 8;
-       mask  = 1 << (aid & 7);
-
-       indexn1 = tim->bitmap_ctrl & 0xfe;
-       indexn2 = elems->tim_len + indexn1 - 4;
-
-       if (index < indexn1 || index > indexn2)
-               return false;
-
-       index -= indexn1;
-
-       return !!(tim->virtual_map[index] & mask);
-}
-
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                           u16 capab, bool erp_valid, u8 erp)
 {
@@ -1806,7 +1782,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                          care_about_ies, ncrc);
 
        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-               directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);
+               directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
+                                                  ifmgd->aid);
 
        ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim));
 

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 11244212f41ddc62c69fc10ddaf7208d625dbdbf..61876eb50b49ef579f1314d45f106333ecc5bce7 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -588,8 +588,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                        elems->cf_params_len = elen;
                        break;
                case WLAN_EID_TIM:
-                       elems->tim = pos;
-                       elems->tim_len = elen;
+                       if (elen >= sizeof(struct ieee80211_tim_ie)) {
+                               elems->tim = (void *)pos;
+                               elems->tim_len = elen;
+                       }
                        break;
                case WLAN_EID_IBSS_PARAMS:
                        elems->ibss_params = pos;