Commit c29b9b9b authored by Johannes Berg's avatar Johannes Berg Committed by David S. Miller

[MAC80211]: don't send invalid QoS frames

Kalle Valo noticed that QoS frames are sent with an invalid QoS control
field; this is because we increase the header length but neither
initialise the space nor actually have enough space in the header
structure for the QoS control field.

This patch fixes it by treating the QoS field specially and appending it
explicitly, initialising it to zero.
Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Acked-by: default avatarMichael Wu <flamingice@sourmilk.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5d4ecd93
...@@ -1487,7 +1487,20 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb, ...@@ -1487,7 +1487,20 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
nh_pos += encaps_len; nh_pos += encaps_len;
h_pos += encaps_len; h_pos += encaps_len;
} }
memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
if (fc & IEEE80211_STYPE_QOS_DATA) {
__le16 *qos_control;
qos_control = (__le16*) skb_push(skb, 2);
memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
/*
* Maybe we could actually set some fields here, for now just
* initialise to zero to indicate no special operation.
*/
*qos_control = 0;
} else
memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
nh_pos += hdrlen; nh_pos += hdrlen;
h_pos += hdrlen; h_pos += hdrlen;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment