Re: [RFC PATCH 1/2] mac80211: 11d Handling - Country Information Element

[Johannes Berg <johannes@sipsolutions.net>]

[-- Attachment #1: Type: text/plain, Size: 1467 bytes --]


> +static void ieee80211_calculate_power_level(struct ieee80211_local *local)
> +{
> +	struct ieee80211_channel *chan = local->hw.conf.channel;
> +
> +	local->hw.conf.power_level = chan->max_power;
> +	if (local->hw.conf.user_pwr_limit)
> +		local->hw.conf.power_level = min(local->hw.conf.user_pwr_limit,
> +			local->hw.conf.power_level);
> +	if (local->hw.conf.tpc_pwr_limit)
> +		local->hw.conf.power_level = min(local->hw.conf.tpc_pwr_limit,
> +			local->hw.conf.power_level);
> +}
> +
>  int ieee80211_hw_config(struct ieee80211_local *local)
>  {
>  	struct ieee80211_channel *chan;
> @@ -1040,13 +1053,7 @@ int ieee80211_hw_config(struct ieee80211_local *local)
>  
>  	local->hw.conf.channel = chan;
>  
> -	if (!local->hw.conf.power_level)
> -		local->hw.conf.power_level = chan->max_power;
> -	else
> -		local->hw.conf.power_level = min(chan->max_power,
> -					       local->hw.conf.power_level);
> -
> -	local->hw.conf.max_antenna_gain = chan->max_antenna_gain;
> +	ieee80211_calculate_power_level(local);

Lost antenna gain setting?
 

> +	if (country_ie_len < 6) {
> +		printk(KERN_ERR "%s: country information element shorter (%d)"
> +			" than expected.\n", __func__, country_ie_len);

Remotely exploitable security bug.


> -	if (local->hw.conf.power_level != new_power_level) {
> -		local->hw.conf.power_level = new_power_level;
> +		 local->hw.conf.user_pwr_limit = 0;

whitespace damage.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]