On Wed, 2015-08-05 at 15:38 +0200, Bertold Van den Bergh wrote:
> The current implementation in ocb.c can cause a kernel oops when the
> interface is up, but no ocb has been joined. When data is received
> with the broadcast BSSID rx_no_sta is called. This function uses
> uninitialized variables because the join function has not yet been
> used.
>
> Signed-off-by: Bertold Van den Bergh <
> bertold.vandenbe...@esat.kuleuven.be>
> ---
> net/mac80211/ocb.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/mac80211/ocb.c b/net/mac80211/ocb.c
> index 573b81a..5da2bd3 100644
> --- a/net/mac80211/ocb.c
> +++ b/net/mac80211/ocb.c
> @@ -50,6 +50,9 @@ void ieee80211_ocb_rx_no_sta(struct
> ieee80211_sub_if_data *sdata,
> struct sta_info *sta;
> int band;
>
> + if (!ifocb->joined)
> + return;
>
Wouldn't it make more sense to put this check into
ieee80211_accept_frame() and, in addition to not doing any station
processing, simply dropping the frame completely? Like such:
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3314,6 +3314,8 @@ static bool ieee80211_accept_frame(struct
ieee80211_rx_data *rx)
}
return true;
case NL80211_IFTYPE_OCB:
+ if (!sdata->u.ocb.joined)
+ return false;
if (!bssid)
return false;
if (ieee80211_is_beacon(hdr->frame_control))
johannes
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
