Commit 4bb29f8c authored by Felix Fietkau's avatar Felix Fietkau Committed by John W. Linville

mac80211: fix rx data handling for non-data frames on multiple vifs

The loop that passes non-data frames to all relevant vifs inside the
__ieee80211_rx_handle_packet keeps a pointer to the previous sdata to
avoid having to make unnecessary copies of the frame it's handling.
This led to a bug that caused it to apply the ieee80211_rx_data state
to the wrong interface, thereby either missing the rx.sta pointer or
having it assigned where it shouldn't be.
This breaks (among other things) aggregation on some vifs, as action
frame exchages are dropped to the cooked monitor interface due to
rx->sta being NULL.
Fix this by restructuring the loop so that it prepares the rx data just
before making the skb copy and calling the rx handlers.

Cc: stable@kernel.org
Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 58da1318
...@@ -2348,22 +2348,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, ...@@ -2348,22 +2348,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
sdata->vif.type == NL80211_IFTYPE_AP_VLAN) sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
continue; continue;
rx.sta = sta_info_get(sdata, hdr->addr2);
rx.flags |= IEEE80211_RX_RA_MATCH;
prepares = prepare_for_handlers(sdata, &rx, hdr);
if (!prepares)
continue;
if (status->flag & RX_FLAG_MMIC_ERROR) {
rx.sdata = sdata;
if (rx.flags & IEEE80211_RX_RA_MATCH)
ieee80211_rx_michael_mic_report(hdr,
&rx);
continue;
}
/* /*
* frame is destined for this interface, but if it's * frame is destined for this interface, but if it's
* not also for the previous one we handle that after * not also for the previous one we handle that after
...@@ -2375,6 +2359,22 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, ...@@ -2375,6 +2359,22 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
continue; continue;
} }
rx.sta = sta_info_get(prev, hdr->addr2);
rx.flags |= IEEE80211_RX_RA_MATCH;
prepares = prepare_for_handlers(prev, &rx, hdr);
if (!prepares)
goto next;
if (status->flag & RX_FLAG_MMIC_ERROR) {
rx.sdata = prev;
if (rx.flags & IEEE80211_RX_RA_MATCH)
ieee80211_rx_michael_mic_report(hdr,
&rx);
goto next;
}
/* /*
* frame was destined for the previous interface * frame was destined for the previous interface
* so invoke RX handlers for it * so invoke RX handlers for it
...@@ -2387,11 +2387,22 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, ...@@ -2387,11 +2387,22 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
"multicast frame for %s\n", "multicast frame for %s\n",
wiphy_name(local->hw.wiphy), wiphy_name(local->hw.wiphy),
prev->name); prev->name);
continue; goto next;
} }
ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate); ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate);
next:
prev = sdata; prev = sdata;
} }
if (prev) {
rx.sta = sta_info_get(prev, hdr->addr2);
rx.flags |= IEEE80211_RX_RA_MATCH;
prepares = prepare_for_handlers(prev, &rx, hdr);
if (!prepares)
prev = NULL;
}
} }
if (prev) if (prev)
ieee80211_invoke_rx_handlers(prev, &rx, skb, rate); ieee80211_invoke_rx_handlers(prev, &rx, skb, rate);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment