2013-07-11 20:37:05

by Johannes Berg

Subject: [PATCH] mac80211: fix duplicate retransmission detection

The duplicate retransmission detection code in mac80211
erroneously attempts to do the check for every frame,
even frames that don't have a sequence control field or
that don't use it (QoS-Null frames.)

This is problematic because it causes the code to access
data beyond the end of the SKB and depending on the data
there will drop packets erroneously.

Correct the code to not do duplicate detection for such
frames.

I found this error while testing AP powersave, it lead
to retransmitted PS-Poll frames being dropped entirely
as the data beyond the end of the SKB was always zero.

Cc: [email protected] [all versions]
Signed-off-by: Johannes Berg <[email protected]>
---
net/mac80211/rx.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 23dbcfc..2c5a79b 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);

- /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
- if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
+ /*
+ * Drop duplicate 802.11 retransmissions
+ * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
+ */
+ if (rx->skb->len >= 24 && rx->sta &&
+ !ieee80211_is_ctl(hdr->frame_control) &&
+ !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
+ !is_multicast_ether_addr(hdr->addr1)) {
if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
rx->sta->last_seq_ctrl[rx->seqno_idx] ==
hdr->seq_ctrl)) {
--
1.8.0

2013-07-15 16:15:51

by Jason Andryuk

Subject: Re: [PATCH] mac80211: fix duplicate retransmission detection

On Sat, Jul 13, 2013 at 4:37 PM, Johannes Berg
<[email protected]> wrote:
> On Sat, 2013-07-13 at 12:28 -0400, Jason Andryuk wrote:
>
>> > + if (rx->skb->len >= 24 && rx->sta &&
>>
>> Shouldn't this check rx->skb first?
>> if (rx->sta && rx->sta->len >= 24 &&
>
> Hmm? did you mean rx->skb? But what makes you think it can be NULL???

Whoops, I totally misread sta v skb. Sorry for the noise.

Jason

2013-07-13 16:28:03

by Jason Andryuk

Subject: Re: [PATCH] mac80211: fix duplicate retransmission detection

On Thu, Jul 11, 2013 at 4:36 PM, Johannes Berg
<[email protected]> wrote:
> diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
> index 23dbcfc..2c5a79b 100644
> --- a/net/mac80211/rx.c
> +++ b/net/mac80211/rx.c
> @@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
> struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
> struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
>
> - /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
> - if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
> + /*
> + * Drop duplicate 802.11 retransmissions
> + * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
> + */
> + if (rx->skb->len >= 24 && rx->sta &&

Shouldn't this check rx->skb first?
if (rx->sta && rx->sta->len >= 24 &&

-Jason

> + !ieee80211_is_ctl(hdr->frame_control) &&
> + !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
> + !is_multicast_ether_addr(hdr->addr1)) {
> if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
> rx->sta->last_seq_ctrl[rx->seqno_idx] ==
> hdr->seq_ctrl)) {
> --
> 1.8.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html

2013-07-13 20:38:10

by Johannes Berg

Subject: Re: [PATCH] mac80211: fix duplicate retransmission detection

On Sat, 2013-07-13 at 12:28 -0400, Jason Andryuk wrote:

> > + if (rx->skb->len >= 24 && rx->sta &&
>
> Shouldn't this check rx->skb first?
> if (rx->sta && rx->sta->len >= 24 &&

Hmm? did you mean rx->skb? But what makes you think it can be NULL???

johannes