mac80211: mesh: fix two small problems

1) there's a spin_lock() that needs to be spin_lock_bh()
2) action frames of size 24 might cause an out-of-bounds
   memory access (for the 25th byte only, so no big deal)

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 542ea025494ee909b4cdd515152837665d6926e6..8a97b1423088140cfe6a28e4860dd02c799bc994 100644 (file)
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -685,9 +685,12 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
        fc = le16_to_cpu(mgmt->frame_control);
 
        switch (fc & IEEE80211_FCTL_STYPE) {
+       case IEEE80211_STYPE_ACTION:
+               if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+                       return RX_DROP_MONITOR;
+               /* fall through */
        case IEEE80211_STYPE_PROBE_RESP:
        case IEEE80211_STYPE_BEACON:
-       case IEEE80211_STYPE_ACTION:
                skb_queue_tail(&ifmsh->skb_queue, skb);
                queue_work(local->hw.workqueue, &ifmsh->work);
                return RX_QUEUED;

diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index f49ef288e2e28841a2e6308c2ab94e83cf2d1717..8e86e910edfcecee4e086294cee44bd4c401d385 100644 (file)
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -686,11 +686,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
        u8 ttl, dst_flags;
        u32 lifetime;
 
-       spin_lock(&ifmsh->mesh_preq_queue_lock);
+       spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
        if (!ifmsh->preq_queue_len ||
                time_before(jiffies, ifmsh->last_preq +
                                min_preq_int_jiff(sdata))) {
-               spin_unlock(&ifmsh->mesh_preq_queue_lock);
+               spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
                return;
        }
 
@@ -698,7 +698,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
                        struct mesh_preq_queue, list);
        list_del(&preq_node->list);
        --ifmsh->preq_queue_len;
-       spin_unlock(&ifmsh->mesh_preq_queue_lock);
+       spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
 
        rcu_read_lock();
        mpath = mesh_path_lookup(preq_node->dst, sdata);