Skip to content

Commit

Permalink
---
Browse files Browse the repository at this point in the history
yaml
---
r: 228055
b: refs/heads/master
c: 4eb28f7
h: refs/heads/master
i:
  228053: c3223e8
  228051: a3aa9b7
  228047: bbd216e
v: v3
  • Loading branch information
Johan Meiring authored and Greg Kroah-Hartman committed Nov 10, 2010
1 parent 831b8db commit 35533fc
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 18 deletions.
2 changes: 1 addition & 1 deletion [refs]
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
---
refs/heads/master: 4c510e95aef6138242ed4bc7fe29ee184bea413f
refs/heads/master: 4eb28f7197a2cbaf7a9be778d429a5fb9bb6172e
45 changes: 28 additions & 17 deletions trunk/drivers/staging/wlan-ng/p80211conv.c
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,8 @@ int skb_ether_to_p80211(wlandevice_t *wlandev, u32 ethconv,

/* tack on SNAP */
e_snap =
(struct wlan_snap *) skb_push(skb, sizeof(struct wlan_snap));
(struct wlan_snap *) skb_push(skb,
sizeof(struct wlan_snap));
e_snap->type = htons(proto);
if (ethconv == WLAN_ETHCONV_8021h
&& p80211_stt_findproto(proto)) {
Expand All @@ -161,7 +162,8 @@ int skb_ether_to_p80211(wlandevice_t *wlandev, u32 ethconv,

/* tack on llc */
e_llc =
(struct wlan_llc *) skb_push(skb, sizeof(struct wlan_llc));
(struct wlan_llc *) skb_push(skb,
sizeof(struct wlan_llc));
e_llc->dsap = 0xAA; /* SNAP, see IEEE 802 */
e_llc->ssap = 0xAA;
e_llc->ctl = 0x03;
Expand Down Expand Up @@ -297,10 +299,12 @@ int skb_p80211_to_ether(wlandevice_t *wlandev, u32 ethconv,
if ((WLAN_GET_FC_TODS(fc) == 0) && (WLAN_GET_FC_FROMDS(fc) == 0)) {
memcpy(daddr, w_hdr->a3.a1, WLAN_ETHADDR_LEN);
memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
} else if ((WLAN_GET_FC_TODS(fc) == 0) && (WLAN_GET_FC_FROMDS(fc) == 1)) {
} else if ((WLAN_GET_FC_TODS(fc) == 0)
&& (WLAN_GET_FC_FROMDS(fc) == 1)) {
memcpy(daddr, w_hdr->a3.a1, WLAN_ETHADDR_LEN);
memcpy(saddr, w_hdr->a3.a3, WLAN_ETHADDR_LEN);
} else if ((WLAN_GET_FC_TODS(fc) == 1) && (WLAN_GET_FC_FROMDS(fc) == 0)) {
} else if ((WLAN_GET_FC_TODS(fc) == 1)
&& (WLAN_GET_FC_FROMDS(fc) == 0)) {
memcpy(daddr, w_hdr->a3.a3, WLAN_ETHADDR_LEN);
memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
} else {
Expand Down Expand Up @@ -349,7 +353,8 @@ int skb_p80211_to_ether(wlandevice_t *wlandev, u32 ethconv,

e_llc = (struct wlan_llc *) (skb->data + payload_offset);
e_snap =
(struct wlan_snap *) (skb->data + payload_offset + sizeof(struct wlan_llc));
(struct wlan_snap *) (skb->data + payload_offset +
sizeof(struct wlan_llc));

/* Test for the various encodings */
if ((payload_length >= sizeof(struct wlan_ethhdr)) &&
Expand All @@ -372,9 +377,11 @@ int skb_p80211_to_ether(wlandevice_t *wlandev, u32 ethconv,
/* chop off the 802.11 CRC */
skb_trim(skb, skb->len - WLAN_CRC_LEN);

} else if ((payload_length >= sizeof(struct wlan_llc) + sizeof(struct wlan_snap))
&& (e_llc->dsap == 0xaa) && (e_llc->ssap == 0xaa)
&& (e_llc->ctl == 0x03)
} else if ((payload_length >= sizeof(struct wlan_llc) +
sizeof(struct wlan_snap))
&&(e_llc->dsap == 0xaa)
&& (e_llc->ssap == 0xaa)
&& (e_llc->ctl == 0x03)
&&
(((memcmp(e_snap->oui, oui_rfc1042, WLAN_IEEE_OUI_LEN) == 0)
&& (ethconv == WLAN_ETHCONV_8021h)
Expand Down Expand Up @@ -406,21 +413,25 @@ int skb_p80211_to_ether(wlandevice_t *wlandev, u32 ethconv,
/* chop off the 802.11 CRC */
skb_trim(skb, skb->len - WLAN_CRC_LEN);

} else if ((payload_length >= sizeof(struct wlan_llc) + sizeof(struct wlan_snap))
&& (e_llc->dsap == 0xaa) && (e_llc->ssap == 0xaa)
&& (e_llc->ctl == 0x03)) {
} else if ((payload_length >= sizeof(struct wlan_llc) +
sizeof(struct wlan_snap))
&&(e_llc->dsap == 0xaa)
&& (e_llc->ssap == 0xaa)
&& (e_llc->ctl == 0x03)) {
pr_debug("802.1h/RFC1042 len: %d\n", payload_length);
/* it's an 802.1h frame || (an RFC1042 && protocol is not in STT) */
/* build a DIXII + RFC894 */
/* it's an 802.1h frame || (an RFC1042 && protocol not in STT)
build a DIXII + RFC894 */

/* Test for an overlength frame */
if ((payload_length - sizeof(struct wlan_llc) - sizeof(struct wlan_snap))
> netdev->mtu) {
if ((payload_length - sizeof(struct wlan_llc) -
sizeof(struct wlan_snap))
> netdev->mtu) {
/* A bogus length ethfrm has been sent. */
/* Is someone trying an oflow attack? */
printk(KERN_ERR "DIXII frame too large (%ld > %d)\n",
(long int)(payload_length - sizeof(struct wlan_llc) -
sizeof(struct wlan_snap)), netdev->mtu);
(long int)(payload_length -
sizeof(struct wlan_llc) -
sizeof(struct wlan_snap)), netdev->mtu);
return 1;
}

Expand Down

0 comments on commit 35533fc

Please sign in to comment.