Attachment 223561 Details for Bug 324191 – proposed patch to ieee80211_sta.c

proposed patch to ieee80211_sta.c

patchfile (text/plain), 7.44 KB, created by David Campbell on 2007-10-10 23:23:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Campbell

Created: 2007-10-10 23:23:00 UTC

Size: 7.44 KB

patch

obsolete

>*** ieee80211_sta.c	2007-10-11 08:41:54.000000000 +1000
>--- ieee80211_sta.c	2007-10-11 09:05:52.000000000 +1000
>***************
>*** 119,124 ****
>--- 119,135 ----
>  
>  enum ParseRes { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 };
>  
>+ static enum ParseRes parse_failed(u8 id, u8 elen, size_t left)
>+ {
>+ #if 0
>+         if (net_ratelimit())
>+           printk(KERN_DEBUG "IEEE 802.11 element parse "
>+                  "failed (id=%d elen=%d left=%d)\n",
>+                  id, elen, left);
>+ #endif
>+         return ParseFailed;
>+ }
>+ 
>  static enum ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
>  					    struct ieee802_11_elems *elems)
>  {
>***************
>*** 135,184 ****
>  		elen = *pos++;
>  		left -= 2;
>  
>- 		if (elen > left) {
>- #if 0
>- 			if (net_ratelimit())
>- 				printk(KERN_DEBUG "IEEE 802.11 element parse "
>- 				       "failed (id=%d elen=%d left=%d)\n",
>- 				       id, elen, left);
>- #endif
>- 			return ParseFailed;
>- 		}
>- 
>  		switch (id) {
>  		case WLAN_EID_SSID:
>  			elems->ssid = pos;
>  			elems->ssid_len = elen;
>  			break;
>  		case WLAN_EID_SUPP_RATES:
>  			elems->supp_rates = pos;
>  			elems->supp_rates_len = elen;
>  			break;
>  		case WLAN_EID_FH_PARAMS:
>  			elems->fh_params = pos;
>  			elems->fh_params_len = elen;
>  			break;
>  		case WLAN_EID_DS_PARAMS:
>  			elems->ds_params = pos;
>  			elems->ds_params_len = elen;
>  			break;
>  		case WLAN_EID_CF_PARAMS:
>  			elems->cf_params = pos;
>  			elems->cf_params_len = elen;
>  			break;
>  		case WLAN_EID_TIM:
>  			elems->tim = pos;
>  			elems->tim_len = elen;
>  			break;
>  		case WLAN_EID_IBSS_PARAMS:
>  			elems->ibss_params = pos;
>  			elems->ibss_params_len = elen;
>  			break;
>  		case WLAN_EID_CHALLENGE:
>  			elems->challenge = pos;
>  			elems->challenge_len = elen;
>  			break;
>  		case WLAN_EID_WPA:
>  			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
>  			    pos[2] == 0xf2) {
>  				/* Microsoft OUI (00:50:F2) */
>--- 146,203 ----
>  		elen = *pos++;
>  		left -= 2;
>  
>  		switch (id) {
>  		case WLAN_EID_SSID:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->ssid = pos;
>  			elems->ssid_len = elen;
>  			break;
>  		case WLAN_EID_SUPP_RATES:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->supp_rates = pos;
>  			elems->supp_rates_len = elen;
>  			break;
>  		case WLAN_EID_FH_PARAMS:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->fh_params = pos;
>  			elems->fh_params_len = elen;
>  			break;
>  		case WLAN_EID_DS_PARAMS:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->ds_params = pos;
>  			elems->ds_params_len = elen;
>  			break;
>  		case WLAN_EID_CF_PARAMS:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->cf_params = pos;
>  			elems->cf_params_len = elen;
>  			break;
>  		case WLAN_EID_TIM:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->tim = pos;
>  			elems->tim_len = elen;
>  			break;
>  		case WLAN_EID_IBSS_PARAMS:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->ibss_params = pos;
>  			elems->ibss_params_len = elen;
>  			break;
>  		case WLAN_EID_CHALLENGE:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->challenge = pos;
>  			elems->challenge_len = elen;
>  			break;
>  		case WLAN_EID_WPA:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
>  			    pos[2] == 0xf2) {
>  				/* Microsoft OUI (00:50:F2) */
>***************
>*** 207,240 ****
>  						elems->tspec_len = elen - 6;
>  						break;
>  					default:
>! 						//printk(KERN_ERR "Unsupported "
>! 						//       "WiFi OUI %d\n", pos[4]);
>  						break;
>  					}
>  				}
>  			}
>  			break;
>  		case WLAN_EID_RSN:
>  			elems->rsn = pos;
>  			elems->rsn_len = elen;
>  			break;
>  		case WLAN_EID_ERP_INFO:
>  			elems->erp_info = pos;
>  			elems->erp_info_len = elen;
>  			break;
>  		case WLAN_EID_EXT_SUPP_RATES:
>  			elems->ext_supp_rates = pos;
>  			elems->ext_supp_rates_len = elen;
>  			break;
>  		case WLAN_EID_HT_CAPABILITY:
>  			elems->ht_cap_param = pos;
>  			elems->ht_cap_param_len = elen;
>  			break;
>  		case WLAN_EID_HT_EXTRA_INFO:
>  			elems->ht_extra_param = pos;
>  			elems->ht_extra_param_len = elen;
>  			break;
>  		case WLAN_EID_TSPEC:
>  			if (elen != 55) {
>  				printk(KERN_ERR "Wrong TSPEC size.\n");
>  				break;
>--- 226,271 ----
>  						elems->tspec_len = elen - 6;
>  						break;
>  					default:
>! 						/*printk(KERN_ERR "Unsupported "
>!                                                   "WiFi OUI %d\n", pos[4]);*/
>  						break;
>  					}
>  				}
>  			}
>  			break;
>  		case WLAN_EID_RSN:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->rsn = pos;
>  			elems->rsn_len = elen;
>  			break;
>  		case WLAN_EID_ERP_INFO:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->erp_info = pos;
>  			elems->erp_info_len = elen;
>  			break;
>  		case WLAN_EID_EXT_SUPP_RATES:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->ext_supp_rates = pos;
>  			elems->ext_supp_rates_len = elen;
>  			break;
>  		case WLAN_EID_HT_CAPABILITY:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->ht_cap_param = pos;
>  			elems->ht_cap_param_len = elen;
>  			break;
>  		case WLAN_EID_HT_EXTRA_INFO:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			elems->ht_extra_param = pos;
>  			elems->ht_extra_param_len = elen;
>  			break;
>  		case WLAN_EID_TSPEC:
>+                         if(elen > left)
>+                                 return parse_failed(id, elen, left);
>  			if (elen != 55) {
>  				printk(KERN_ERR "Wrong TSPEC size.\n");
>  				break;
>***************
>*** 243,254 ****
>--- 274,301 ----
>  			elems->tspec_len = elen;
>  			break;
>  		default:
>+                        /* some A/P's return unknown ids, or an incorrect
>+                         * frame length that puts invalid data at the 
>+                         * end of the frame
>+                         */
>  #if 0
>  			printk(KERN_DEBUG "IEEE 802.11 element parse ignored "
>  				      "unknown element (id=%d elen=%d)\n",
>  				      id, elen);
>  #endif
>  			unknown++;
>+                         if(elen > left) {
>+                                 /* some A/P's have an incorrect frame
>+                                  * length that leaves corrupt data at the
>+                                  * end of the frame... and at this point
>+                                  * we cannot continue due to incorrect
>+                                  * elen
>+                                  */
>+ #if 0
>+                                 printk(KERN_DEBUG "Bad element id=%d has bad elen=%d in unknown element, left=%d - truncating frame\n", id, elen, left);
>+ #endif
>+                                 return ParseUnknown;
>+                         }
>  			break;
>  		}
>

Actions: View

Attachments on bug 324191: 223561 | 224811