Re: [PATCH] mac80211: improved ieee80211_verify_alignment

[Johannes Berg <johannes@sipsolutions.net>]

[-- Attachment #1: Type: text/plain, Size: 1346 bytes --]

On Sat, 2009-11-28 at 15:47 +0100, Benoit Papillault wrote:
> From: Benoit PAPILLAULT <benoit.papillault@free.fr>
> 
> ieee80211_verify_alignment has been improved to avoid small 802.11 frame (<2
> bytes) and skip checking for data alignment when there is no 802.11 data (when
> the frame length is less or egal to the header length)

None of this is necessary.

> --- a/net/mac80211/rx.c
> +++ b/net/mac80211/rx.c
> @@ -386,10 +386,23 @@ static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
>  		      "unaligned packet at 0x%p\n", rx->skb->data))
>  		return;
>  
> +	/* before using the hdr->frame_control field, we need to check that
> +	 * skb contains at least 2 bytes */
> +
> +	if (rx->skb->len < 2)
> +		return ;
> +

Frames shorter than 16 bytes never reach this point.

>  	if (!ieee80211_is_data_present(hdr->frame_control))
>  		return;
>  
>  	hdrlen = ieee80211_hdrlen(hdr->frame_control);
> +
> +	/* before checking data alignment, we need to check that skb contains
> +	 * at least 1 byte of data */
> +
> +	if (rx->skb->len <= hdrlen)
> +		return;
> +

Even if this could happen it's not true -- we do not need a byte of data
to verify that it's aligned properly. After all, even the empty string
can be aligned -- we never actually dereference the data there.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]