Re: [PATCH] mac80211: Fix oops in OCB mode when receiving data when not joined

[Johannes Berg <johannes@sipsolutions.net>]

On Thu, 2015-08-13 at 11:09 +0200, Johannes Berg wrote:
> On Wed, 2015-08-05 at 15:38 +0200, Bertold Van den Bergh wrote:
> > The current implementation in ocb.c can cause a kernel oops when 
> > the
> > interface is up, but no ocb has been joined. When data is received
> > with the broadcast BSSID rx_no_sta is called. This function uses
> > uninitialized variables because the join function has not yet been 
> > used.
> > 
> > Signed-off-by: Bertold Van den Bergh <
> > bertold.vandenbergh@esat.kuleuven.be>
> > ---
> >  net/mac80211/ocb.c | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git a/net/mac80211/ocb.c b/net/mac80211/ocb.c
> > index 573b81a..5da2bd3 100644
> > --- a/net/mac80211/ocb.c
> > +++ b/net/mac80211/ocb.c
> > @@ -50,6 +50,9 @@ void ieee80211_ocb_rx_no_sta(struct 
> > ieee80211_sub_if_data *sdata,
> >  	struct sta_info *sta;
> >  	int band;
> >  
> > +	if (!ifocb->joined)
> > +		return;
> > 
> Wouldn't it make more sense to put this check into
> ieee80211_accept_frame() and, in addition to not doing any station
> processing, simply dropping the frame completely? Like such:
> 

Reminder? I'm not sure what to do with this patch - I don't
particularly like processing the frame at all.

johannes