mac80211: strictly check mesh address extension mode
authorRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Mon, 15 May 2017 04:41:55 +0000 (21:41 -0700)
committerRaspbian kernel package updater <root@raspbian.org>
Sun, 23 Jul 2017 03:00:30 +0000 (03:00 +0000)
commit18d05624304fb8f0e46141e01de219eaee79083e
tree041e93a2e08d2c77491f585f31205e6ac7f4d756
parente25d4712f48bdaf5497acbc7dbb12cf9afca5fe9
mac80211: strictly check mesh address extension mode

commit 5667c86acf021e6dcf02584408b4484a273ac68f upstream.

Mesh forwarding path checks for address extension mode to fetch
appropriate proxied address and MPP address. Existing condition
that looks for 6 address format is not strict enough so that
frames with improper values are processed and invalid entries
are added into MPP table. Fix that by adding a stricter check before
processing the packet.

Per IEEE Std 802.11s-2011 spec. Table 7-6g1 lists address extension
mode 0x3 as reserved one. And also Table Table 9-13 does not specify
0x3 as valid address field.

Fixes: 9b395bc3be1c ("mac80211: verify that skb data is present")
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/mac80211/rx.c
net/wireless/util.c