mac80211: linearize SKBs as needed for crypto

[mirror_ubuntu-zesty-kernel.git] / net / mac80211 / wep.c

diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 5cd87ba11bb721a78ca2dc41324e49587671aca6..7aa31bbfaa3bf7387df2756bf94877cc15fdda9a 100644 (file)
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -284,22 +284,27 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
        struct sk_buff *skb = rx->skb;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+       __le16 fc = hdr->frame_control;
 
-       if (!ieee80211_is_data(hdr->frame_control) &&
-           !ieee80211_is_auth(hdr->frame_control))
+       if (!ieee80211_is_data(fc) && !ieee80211_is_auth(fc))
                return RX_CONTINUE;
 
        if (!(status->flag & RX_FLAG_DECRYPTED)) {
+               if (skb_linearize(rx->skb))
+                       return RX_DROP_UNUSABLE;
                if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
                        rx->sta->wep_weak_iv_count++;
                if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
                        return RX_DROP_UNUSABLE;
        } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+               if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) + WEP_IV_LEN))
+                       return RX_DROP_UNUSABLE;
                if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
                        rx->sta->wep_weak_iv_count++;
                ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
                /* remove ICV */
-               skb_trim(rx->skb, rx->skb->len - WEP_ICV_LEN);
+               if (pskb_trim(rx->skb, rx->skb->len - WEP_ICV_LEN))
+                       return RX_DROP_UNUSABLE;
        }
 
        return RX_CONTINUE;