diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2014-03-04 13:46:53 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-03-23 21:38:12 -0700 |
| commit | 30f754e9d9e0508024e6f872dfc888551102875f (patch) | |
| tree | f06a92195f1ebc6fa4bfd0bc1105c0680d8ff225 /net/mac80211 | |
| parent | c02d9a9697134e6fd6527c33ae0d78a8faad6e41 (diff) | |
| download | linux-3.10-30f754e9d9e0508024e6f872dfc888551102875f.tar.gz linux-3.10-30f754e9d9e0508024e6f872dfc888551102875f.tar.bz2 linux-3.10-30f754e9d9e0508024e6f872dfc888551102875f.zip | |
mac80211: clear sequence/fragment number in QoS-null frames
commit 864a6040f395464003af8dd0d8ca86fed19866d4 upstream.
Avoid leaking data by sending uninitialized memory and setting an
invalid (non-zero) fragment number (the sequence number is ignored
anyway) by setting the seq_ctrl field to zero.
Fixes: 3f52b7e328c5 ("mac80211: mesh power save basics")
Fixes: ce662b44ce22 ("mac80211: send (QoS) Null if no buffered frames")
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/mesh_ps.c | 1 | ||||
| -rw-r--r-- | net/mac80211/sta_info.c | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c index 3b7bfc01ee3..ddda201832b 100644 --- a/net/mac80211/mesh_ps.c +++ b/net/mac80211/mesh_ps.c @@ -36,6 +36,7 @@ static struct sk_buff *mps_qos_null_get(struct sta_info *sta) sdata->vif.addr); nullfunc->frame_control = fc; nullfunc->duration_id = 0; + nullfunc->seq_ctrl = 0; /* no address resolution for this frame -> set addr 1 immediately */ memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN); memset(skb_put(skb, 2), 0, 2); /* append QoS control field */ diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index a66d0068a66..0418777c361 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -1114,6 +1114,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata, memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN); memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN); memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN); + nullfunc->seq_ctrl = 0; skb->priority = tid; skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]); |