Skip to content

Commit

Permalink
don't use net/ieee80211.h
Browse files Browse the repository at this point in the history 
Convert all the drivers using net/ieee80211.h to use linux/ieee80211.h.
Contains a bugfix in libertas where the SSID parsing could overrun the
buffer when the AP sends invalid information.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Acked-by: Dan Williams <dcbw@redhat.com> [airo, libertas]
Acked-by: Pavel Roskin <proski@gnu.org> [orinoco]
Acked-by: David Kilroy <kilroyd@googlemail.com> [orinoco]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Johannes Berg authored and John W. Linville committed Nov 10, 2008
1 parent 9b1fbae commit 2c70600
Show file tree
Hide file tree
Showing 17 changed files with 167 additions and 158 deletions.
17 changes: 9 additions & 8 deletions drivers/net/ps3_gelic_wireless.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,11 @@
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/wireless.h>
#include <linux/ieee80211.h>
#include <linux/if_arp.h>
#include <linux/ctype.h>
#include <linux/string.h>
#include <net/iw_handler.h>
#include <net/ieee80211.h>

#include <linux/dma-mapping.h>
#include <net/checksum.h>
Expand Down Expand Up @@ -449,9 +450,9 @@ static size_t gelic_wl_synthesize_ie(u8 *buf,

/* element id */
if (rsn)
*buf++ = MFIE_TYPE_RSN;
*buf++ = WLAN_EID_RSN;
else
*buf++ = MFIE_TYPE_GENERIC;
*buf++ = WLAN_EID_GENERIC;

/* length filed; set later */
buf++;
Expand Down Expand Up @@ -539,15 +540,15 @@ static void gelic_wl_parse_ie(u8 *data, size_t len,
break;

switch (item_id) {
case MFIE_TYPE_GENERIC:
case WLAN_EID_GENERIC:
if ((OUI_LEN + 1 <= item_len) &&
!memcmp(pos, wpa_oui, OUI_LEN) &&
pos[OUI_LEN] == 0x01) {
ie_info->wpa.data = pos - 2;
ie_info->wpa.len = item_len + 2;
}
break;
case MFIE_TYPE_RSN:
case WLAN_EID_RSN:
ie_info->rsn.data = pos - 2;
/* length includes the header */
ie_info->rsn.len = item_len + 2;
Expand Down Expand Up @@ -581,7 +582,7 @@ static char *gelic_wl_translate_scan(struct net_device *netdev,
char *tmp;
u8 rate;
unsigned int i, j, len;
u8 buf[MAX_WPA_IE_LEN];
u8 buf[64]; /* arbitrary size large enough */

pr_debug("%s: <-\n", __func__);

Expand Down Expand Up @@ -1734,14 +1735,14 @@ static void gelic_wl_scan_complete_event(struct gelic_wl_info *wl)
target->essid_len = strnlen(scan_info->essid,
sizeof(scan_info->essid));
target->rate_len = 0;
for (r = 0; r < MAX_RATES_LENGTH; r++)
for (r = 0; r < 12; r++)
if (scan_info->rate[r])
target->rate_len++;
if (8 < target->rate_len)
pr_info("%s: AP returns %d rates\n", __func__,
target->rate_len);
target->rate_ext_len = 0;
for (r = 0; r < MAX_RATES_EX_LENGTH; r++)
for (r = 0; r < 16; r++)
if (scan_info->ext_rate[r])
target->rate_ext_len++;
list_move_tail(&target->list, &wl->network_list);
Expand Down
4 changes: 2 additions & 2 deletions drivers/net/ps3_gelic_wireless.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -164,8 +164,8 @@ struct gelic_eurus_scan_info {
__be16 security;
u8 bssid[8]; /* last ETH_ALEN are valid. bssid[0],[1] are unused */
u8 essid[32]; /* IW_ESSID_MAX_SIZE */
u8 rate[16]; /* first MAX_RATES_LENGTH(12) are valid */
u8 ext_rate[16]; /* first MAX_RATES_EX_LENGTH(16) are valid */
u8 rate[16]; /* first 12 are valid */
u8 ext_rate[16]; /* first 16 are valid */
__be32 reserved1;
__be32 reserved2;
__be32 reserved3;
Expand Down
50 changes: 24 additions & 26 deletions drivers/net/wireless/airo.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,10 +47,11 @@
#include <linux/ioport.h>
#include <linux/pci.h>
#include <asm/uaccess.h>
#include <net/ieee80211.h>
#include <linux/kthread.h>
#include <linux/freezer.h>

#include <linux/ieee80211.h>

#include "airo.h"

#define DRV_NAME "airo"
Expand Down Expand Up @@ -7265,56 +7266,53 @@ static inline char *airo_translate_scan(struct net_device *dev,
if (test_bit(FLAG_WPA_CAPABLE, &ai->flags)) {
unsigned int num_null_ies = 0;
u16 length = sizeof (bss->extra.iep);
struct ieee80211_info_element *info_element =
(struct ieee80211_info_element *) &bss->extra.iep;
u8 *ie = (void *)&bss->extra.iep;

while ((length >= sizeof(*info_element)) && (num_null_ies < 2)) {
if (sizeof(*info_element) + info_element->len > length) {
while ((length >= 2) && (num_null_ies < 2)) {
if (2 + ie[1] > length) {
/* Invalid element, don't continue parsing IE */
break;
}

switch (info_element->id) {
case MFIE_TYPE_SSID:
switch (ie[0]) {
case WLAN_EID_SSID:
/* Two zero-length SSID elements
* mean we're done parsing elements */
if (!info_element->len)
if (!ie[1])
num_null_ies++;
break;

case MFIE_TYPE_GENERIC:
if (info_element->len >= 4 &&
info_element->data[0] == 0x00 &&
info_element->data[1] == 0x50 &&
info_element->data[2] == 0xf2 &&
info_element->data[3] == 0x01) {
case WLAN_EID_GENERIC:
if (ie[1] >= 4 &&
ie[2] == 0x00 &&
ie[3] == 0x50 &&
ie[4] == 0xf2 &&
ie[5] == 0x01) {
iwe.cmd = IWEVGENIE;
iwe.u.data.length = min(info_element->len + 2,
MAX_WPA_IE_LEN);
/* 64 is an arbitrary cut-off */
iwe.u.data.length = min(ie[1] + 2,
64);
current_ev = iwe_stream_add_point(
info, current_ev,
end_buf, &iwe,
(char *) info_element);
end_buf, &iwe, ie);
}
break;

case MFIE_TYPE_RSN:
case WLAN_EID_RSN:
iwe.cmd = IWEVGENIE;
iwe.u.data.length = min(info_element->len + 2,
MAX_WPA_IE_LEN);
/* 64 is an arbitrary cut-off */
iwe.u.data.length = min(ie[1] + 2, 64);
current_ev = iwe_stream_add_point(
info, current_ev, end_buf,
&iwe, (char *) info_element);
&iwe, ie);
break;

default:
break;
}

length -= sizeof(*info_element) + info_element->len;
info_element =
(struct ieee80211_info_element *)&info_element->
data[info_element->len];
length -= 2 + ie[1];
ie += 2 + ie[1];
}
}
return current_ev;
Expand Down
Loading

0 comments on commit 2c70600

Please sign in to comment.