aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2016-10-05 10:14:42 +0200
committerSasha Levin <alexander.levin@verizon.com>2016-11-23 22:56:41 -0500
commitfa3fcdd3d3564cc0d5b65e55ebc3f874fed370c0 (patch)
tree2f1e777f5ed2ca48774a43fe942cbf2bf5fbf384
parent7d9ad295527ff08a9f44aa71e2d77a84f57efcd1 (diff)
downloadlinux-linaro-stable-fa3fcdd3d3564cc0d5b65e55ebc3f874fed370c0.tar.gz
mac80211: discard multicast and 4-addr A-MSDUs
[ Upstream commit ea720935cf6686f72def9d322298bf7e9bd53377 ] In mac80211, multicast A-MSDUs are accepted in many cases that they shouldn't be accepted in: * drop A-MSDUs with a multicast A1 (RA), as required by the spec in 9.11 (802.11-2012 version) * drop A-MSDUs with a 4-addr header, since the fourth address can't actually be useful for them; unless 4-address frame format is actually requested, even though the fourth address is still not useful in this case, but ignored Accepting the first case, in particular, is very problematic since it allows anyone else with possession of a GTK to send unicast frames encapsulated in a multicast A-MSDU, even when the AP has client isolation enabled. Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
-rw-r--r--net/mac80211/rx.c24
1 files changed, 15 insertions, 9 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c848d0b38c86..bb6f6ef07566 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2040,16 +2040,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
if (!(status->rx_flags & IEEE80211_RX_AMSDU))
return RX_CONTINUE;
- if (ieee80211_has_a4(hdr->frame_control) &&
- rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
- !rx->sdata->u.vlan.sta)
- return RX_DROP_UNUSABLE;
+ if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+ switch (rx->sdata->vif.type) {
+ case NL80211_IFTYPE_AP_VLAN:
+ if (!rx->sdata->u.vlan.sta)
+ return RX_DROP_UNUSABLE;
+ break;
+ case NL80211_IFTYPE_STATION:
+ if (!rx->sdata->u.mgd.use_4addr)
+ return RX_DROP_UNUSABLE;
+ break;
+ default:
+ return RX_DROP_UNUSABLE;
+ }
+ }
- if (is_multicast_ether_addr(hdr->addr1) &&
- ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
- rx->sdata->u.vlan.sta) ||
- (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
- rx->sdata->u.mgd.use_4addr)))
+ if (is_multicast_ether_addr(hdr->addr1))
return RX_DROP_UNUSABLE;
skb->dev = dev;