Skip to content

Commit

Permalink
mac80211: Only process mesh config header on frames that RA_MATCH
Browse files Browse the repository at this point in the history
Doing otherwise is wrong, and may wreak havoc on the mpp tables,
specially if the frame is encrypted.

Cc: stable@vger.kernel.org
Reported-by: Chaoxing Lin <Chaoxing.Lin@ultra-3eti.com>
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  • Loading branch information
Javier Cardona authored and Johannes Berg committed Oct 25, 2012
1 parent 9690fb1 commit 555cb71
Showing 1 changed file with 2 additions and 4 deletions.
6 changes: 2 additions & 4 deletions net/mac80211/rx.c
Original file line number Diff line number Diff line change
Expand Up @@ -1897,7 +1897,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
return RX_DROP_MONITOR;

if (!ieee80211_is_data(hdr->frame_control))
if (!ieee80211_is_data(hdr->frame_control) ||
!(status->rx_flags & IEEE80211_RX_RA_MATCH))
return RX_CONTINUE;

if (!mesh_hdr->ttl)
Expand Down Expand Up @@ -1941,9 +1942,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
}
skb_set_queue_mapping(skb, q);

if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
goto out;

if (!--mesh_hdr->ttl) {
IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
return RX_DROP_MONITOR;
Expand Down

0 comments on commit 555cb71

Please sign in to comment.