Changeset 2348

Timestamp:

05/18/07 06:58:44 (2 years ago)

Author:

mrenzmann

Message:

Don't accept invalid beacon interval values (such as 0), neither
locally (for AP VAPs) nor from remote (in scanning results). The value
is used as divisor, which might cause an oops due to "division by zero"
and other unwanted behaviour. Closes #1270.

Thanks to Md Sohail Ahmad from AirTight? Networks Inc., who reported
this issue and provided a first patch.

Files:

• trunk/net80211/ieee80211_input.c (modified) (3 diffs)
• trunk/net80211/ieee80211_node.c (modified) (2 diffs)
• trunk/net80211/ieee80211_scan.h (modified) (1 diff)
• trunk/net80211/ieee80211_var.h (modified) (1 diff)
• trunk/net80211/ieee80211_wireless.c (modified) (2 diffs)

trunk/net80211/ieee80211_input.c

@@ -2768 +2768 @@
-                        return;
-                }
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                /*
-                 * Count frame now that we know it's to be processed.
@@ -2896 +2909 @@
-                                memcpy(ni->ni_tstamp.data, scan.tstamp,
-                                        sizeof(ni->ni_tstamp));
-scan.bintval
+IEEE80211_BINTVAL_SANITISE(scan.bintval)
-                                ni->ni_capinfo = scan.capinfo;
-                                ni->ni_chan = ic->ic_curchan;
@@ -3320 +3333 @@
-                ni->ni_rstamp = rstamp;
-                ni->ni_last_rx = jiffies;
-bintval
+IEEE80211_BINTVAL_SANITISE(bintval)
-                ni->ni_capinfo = capinfo;
-                ni->ni_chan = ic->ic_curchan;

trunk/net80211/ieee80211_node.c

@@ -661 +661 @@
-        ni->ni_rstamp = se->se_rstamp;
-        ni->ni_tstamp.tsf = se->se_tstamp.tsf;
-se->se_intval
+IEEE80211_BINTVAL_SANITISE(se->se_intval)
-        ni->ni_capinfo = se->se_capinfo;
-        ni->ni_chan = se->se_chan;
@@ -1216 +1216 @@
-                IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
-                memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
-sp->bintval
+IEEE80211_BINTVAL_SANITISE(sp->bintval)
-                ni->ni_capinfo = sp->capinfo;
-                ni->ni_chan = ic->ic_curchan;

trunk/net80211/ieee80211_scan.h

@@ -131 +131 @@
-        u_int8_t fhindex;
-        u_int8_t erp;
-8
+16
-        u_int8_t timoff;
-        u_int8_t *tim;

trunk/net80211/ieee80211_var.h

@@ -61 +61 @@
-#define IEEE80211_DTIM_DEFAULT  1       /* default DTIM period */
-
-5
+10
-#define IEEE80211_BINTVAL_MIN   25      /* min beacon interval (TU's) */
-#define IEEE80211_BINTVAL_DEFAULT 100   /* default beacon interval (TU's) */
+#define IEEE80211_BINTVAL_VALID(_bi) \
+        ((IEEE80211_BINTVAL_MIN <= (_bi)) && \
+         ((_bi) <= IEEE80211_BINTVAL_MAX))
+#define IEEE80211_BINTVAL_SANITISE(_bi) \
+        (IEEE80211_BINTVAL_VALID(_bi) ? \
+         (_bi) : IEEE80211_BINTVAL_DEFAULT)
-
-#define IEEE80211_BGSCAN_INTVAL_MIN     15      /* min bg scan intvl (secs) */

trunk/net80211/ieee80211_wireless.c

@@ -1274 +1274 @@
-                case IW_POWER_ALL_R:
-                case IW_POWER_ON:
-
-
+
+
+
+
+
+
-                        if (wrq->flags & IW_POWER_TIMEOUT)
-                                ic->ic_holdover = IEEE80211_MS_TO_TU(wrq->value);
-if (wrq->flags & IW_POWER_PERIOD)
-       ic->ic_lintval = IEEE80211_MS_TO_TU(wrq->value)
+
+ic->ic_flags |= IEEE80211_F_PMGTON
-                        break;
-                default:
@@ -2366 +2370 @@
-                    vap->iv_opmode != IEEE80211_M_IBSS)
-                        return -EINVAL;
-
-
+
-                        ic->ic_lintval = value;         /* XXX multi-bss */
-                        retv = ENETRESET;               /* requires restart */