summaryrefslogtreecommitdiff
path: root/include/linux/ieee80211.h
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2014-01-23 19:20:29 +0400
committerJohannes Berg <johannes.berg@intel.com>2014-02-05 00:58:07 +0400
commitd8ca16db6bb23d03fcb794df44bae64ae976f27c (patch)
treef577a829374c0f9daba8bf70e1ea3d6ac107089c /include/linux/ieee80211.h
parentae811e21df28deb4c2adab0a47fc3da4f56d777b (diff)
downloadlinux-d8ca16db6bb23d03fcb794df44bae64ae976f27c.tar.xz
mac80211: add length check in ieee80211_is_robust_mgmt_frame()
A few places weren't checking that the frame passed to the function actually has enough data even though the function clearly documents it must have a payload byte. Make this safer by changing the function to take an skb and checking the length inside. The old version is preserved for now as the rtl* drivers use it and don't have a correct skb. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'include/linux/ieee80211.h')
-rw-r--r--include/linux/ieee80211.h15
1 files changed, 13 insertions, 2 deletions
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index e526a8cecb70..923c478030a3 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -2192,10 +2192,10 @@ static inline u8 *ieee80211_get_DA(struct ieee80211_hdr *hdr)
}
/**
- * ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
+ * _ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
* @hdr: the frame (buffer must include at least the first octet of payload)
*/
-static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
+static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
{
if (ieee80211_is_disassoc(hdr->frame_control) ||
ieee80211_is_deauth(hdr->frame_control))
@@ -2224,6 +2224,17 @@ static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
}
/**
+ * ieee80211_is_robust_mgmt_frame - check if skb contains a robust mgmt frame
+ * @skb: the skb containing the frame, length will be checked
+ */
+static inline bool ieee80211_is_robust_mgmt_frame(struct sk_buff *skb)
+{
+ if (skb->len < 25)
+ return false;
+ return _ieee80211_is_robust_mgmt_frame((void *)skb->data);
+}
+
+/**
* ieee80211_is_public_action - check if frame is a public action frame
* @hdr: the frame
* @len: length of the frame