From patchwork Fri Feb 3 13:38:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 9554127 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 15714602B7 for ; Fri, 3 Feb 2017 13:52:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 042852815E for ; Fri, 3 Feb 2017 13:52:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EC7C2281A7; Fri, 3 Feb 2017 13:52:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3A4CB2815E for ; Fri, 3 Feb 2017 13:52:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752357AbdBCNwq (ORCPT ); Fri, 3 Feb 2017 08:52:46 -0500 Received: from narfation.org ([79.140.41.39]:56490 "EHLO v3-1039.vlinux.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752272AbdBCNwp (ORCPT ); Fri, 3 Feb 2017 08:52:45 -0500 X-Greylist: delayed 531 seconds by postgrey-1.27 at vger.kernel.org; Fri, 03 Feb 2017 08:52:45 EST Received: from sven-desktop.home.narfation.org (p2003007C6F65DCFEE47A19FDD989EC64.dip0.t-ipconnect.de [IPv6:2003:7c:6f65:dcfe:e47a:19fd:d989:ec64]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id D4F5F1100CD; Fri, 3 Feb 2017 14:43:50 +0100 (CET) Authentication-Results: v3-1039.vlinux.de; dmarc=none header.from=narfation.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=narfation.org; s=20121; t=1486129431; bh=VcGNv2WCHzP5j0kiIis4Hoib+yiAPnrNuGDQ0tVVJqY=; h=From:To:Cc:Subject:Date:From; b=hetTYdMdWVz+NeUqbXAGw/ewZD58kOQZEyWCNsqSNjWlzr8RkNzNsiJcI+JoXoylz azuwe/+xXX/wUwfExeSWFyrd1O6yawudYLZKZSBJkfoOUbO7XARBfCE/sdxt+uNnBE VIsSpODznPtkHZG9wlIxFhOtLys2Jia0zONw6K0U= From: Sven Eckelmann To: linux-wireless@vger.kernel.org Cc: johannes@sipsolutions.net, Thorsten Horstmann , Mathias Kretschmer , Simon Wunderlich , Sven Eckelmann Subject: [PATCH] mac80211: Fix adding of mesh vendor IEs Date: Fri, 3 Feb 2017 14:38:29 +0100 Message-Id: <20170203133829.3219-1-sven@narfation.org> X-Mailer: git-send-email 2.11.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Thorsten Horstmann The function ieee80211_ie_split_vendor doesn't return 0 on errors. Instead it returns any offset < ielen when WLAN_EID_VENDOR_SPECIFIC is found. The return value in mesh_add_vendor_ies must therefore be checked against ifmsh->ie_len and not 0. Otherwise all ifmsh->ie starting with WLAN_EID_VENDOR_SPECIFIC will be rejected. Fixes: 082ebb0c258d ("mac80211: fix mesh beacon format") Signed-off-by: Thorsten Horstmann Signed-off-by: Mathias Kretschmer Signed-off-by: Simon Wunderlich [sven@narfation.org: Add commit message] Signed-off-by: Sven Eckelmann --- net/mac80211/mesh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c index d36c7f4c0c7e..6e7b6a07b7d5 100644 --- a/net/mac80211/mesh.c +++ b/net/mac80211/mesh.c @@ -335,7 +335,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata, /* fast-forward to vendor IEs */ offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0); - if (offset) { + if (offset < ifmsh->ie_len) { len = ifmsh->ie_len - offset; data = ifmsh->ie + offset; if (skb_tailroom(skb) < len)