From patchwork Thu Dec 22 15:06:21 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [hardy, CVE, 1/2] ieee80211: Add IEEE80211_MAX_FRAME_LEN to linux/ieee80211.h Date: Thu, 22 Dec 2011 05:06:21 -0000 From: Andy Whitcroft X-Patchwork-Id: 132860 Message-Id: <1324566383-30777-2-git-send-email-apw@canonical.com> To: kernel-team@lists.ubuntu.com Cc: Andy Whitcroft From: Michael Wu This patch adds IEEE80211_MAX_FRAME_LEN which is useful for drivers trying to determine how much to allocate for their RX buffers. It also updates the comment on IEEE80211_MAX_DATA_LEN based on revisions in 802.11e. IEEE80211_MAX_FRAG_THRESHOLD and IEEE80211_MAX_RTS_THRESHOLD are also revised due to the new maximum frame size. Signed-off-by: Michael Wu Signed-off-by: John W. Linville Signed-off-by: David S. Miller (cherry picked from commit c237899d1f8c5bfcfc9d6204052e0e065827ff75) CVE-2011-3359 BugLink: http://bugs.launchpad.net/bugs/905060 Signed-off-by: Andy Whitcroft --- include/linux/ieee80211.h | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index 30621c2..214821a 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -81,18 +81,18 @@ /* miscellaneous IEEE 802.11 constants */ -#define IEEE80211_MAX_FRAG_THRESHOLD 2346 -#define IEEE80211_MAX_RTS_THRESHOLD 2347 +#define IEEE80211_MAX_FRAG_THRESHOLD 2352 +#define IEEE80211_MAX_RTS_THRESHOLD 2353 #define IEEE80211_MAX_AID 2007 #define IEEE80211_MAX_TIM_LEN 251 -#define IEEE80211_MAX_DATA_LEN 2304 /* Maximum size for the MA-UNITDATA primitive, 802.11 standard section 6.2.1.1.2. - The figure in section 7.1.2 suggests a body size of up to 2312 - bytes is allowed, which is a bit confusing, I suspect this - represents the 2304 bytes of real data, plus a possible 8 bytes of - WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */ + 802.11e clarifies the figure in section 7.1.2. The frame body is + up to 2304 octets long (maximum MSDU size) plus any crypt overhead. */ +#define IEEE80211_MAX_DATA_LEN 2304 +/* 30 byte 4 addr hdr, 2 byte QoS, 2304 byte MSDU, 12 byte crypt, 4 byte FCS */ +#define IEEE80211_MAX_FRAME_LEN 2352 #define IEEE80211_MAX_SSID_LEN 32