diff options
author | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2017-06-17 17:01:11 +0200 |
---|---|---|
committer | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2017-06-17 17:01:11 +0200 |
commit | c1d5fe2d54551b95b812143d94d8168da2220dd8 (patch) | |
tree | fdde4472ab2b19fcadaae22d68a0c9b008f74373 /net/mac80211/rx.c | |
parent | 0068a1b36d309f22698f7de7478b72e672360129 (diff) | |
parent | 1bd30958ec55d80ca72d2ca4e7e5c3d9fbf3173e (diff) |
Merge tag 'v4.4.73' into toradex_vf_4.4-nextColibri-VF_LXDE-Image_2.7b3-20170630
This is the 4.4.73 stable release
Diffstat (limited to 'net/mac80211/rx.c')
-rw-r--r-- | net/mac80211/rx.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 2b528389409f..9f0915f72702 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -3396,6 +3396,27 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) !ether_addr_equal(bssid, hdr->addr1)) return false; } + + /* + * 802.11-2016 Table 9-26 says that for data frames, A1 must be + * the BSSID - we've checked that already but may have accepted + * the wildcard (ff:ff:ff:ff:ff:ff). + * + * It also says: + * The BSSID of the Data frame is determined as follows: + * a) If the STA is contained within an AP or is associated + * with an AP, the BSSID is the address currently in use + * by the STA contained in the AP. + * + * So we should not accept data frames with an address that's + * multicast. + * + * Accepting it also opens a security problem because stations + * could encrypt it with the GTK and inject traffic that way. + */ + if (ieee80211_is_data(hdr->frame_control) && multicast) + return false; + return true; case NL80211_IFTYPE_WDS: if (bssid || !ieee80211_is_data(hdr->frame_control)) |