Commit 8ae5977f authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville

mac80211: fix blockack-req processing

Daniel reported that the paged RX changes had
broken blockack request frame processing due
to using data that wasn't really part of the
skb data.

Fix this using skb_copy_bits() for the needed
data. As a side effect, this adds a check on
processing too short frames, which previously
this code could do.
Reported-by: default avatarDaniel Halperin <dhalperi@cs.washington.edu>
Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Acked-by: default avatarDaniel Halperin <dhalperi@cs.washington.edu>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 397f385b
...@@ -1818,17 +1818,26 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) ...@@ -1818,17 +1818,26 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
return RX_CONTINUE; return RX_CONTINUE;
if (ieee80211_is_back_req(bar->frame_control)) { if (ieee80211_is_back_req(bar->frame_control)) {
struct {
__le16 control, start_seq_num;
} __packed bar_data;
if (!rx->sta) if (!rx->sta)
return RX_DROP_MONITOR; return RX_DROP_MONITOR;
if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
&bar_data, sizeof(bar_data)))
return RX_DROP_MONITOR;
spin_lock(&rx->sta->lock); spin_lock(&rx->sta->lock);
tid = le16_to_cpu(bar->control) >> 12; tid = le16_to_cpu(bar_data.control) >> 12;
if (!rx->sta->ampdu_mlme.tid_active_rx[tid]) { if (!rx->sta->ampdu_mlme.tid_active_rx[tid]) {
spin_unlock(&rx->sta->lock); spin_unlock(&rx->sta->lock);
return RX_DROP_MONITOR; return RX_DROP_MONITOR;
} }
tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid]; tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4; start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
/* reset session timer */ /* reset session timer */
if (tid_agg_rx->timeout) if (tid_agg_rx->timeout)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment