2013-03-08 10:09:58

by Johannes Berg

Subject: [PATCH] mac80211: fix crash with P2P Device returning action frames

From: Johannes Berg <[email protected]>

If a P2P Device interface receives an unhandled action
frame, we attempt to return it. This crashes because it
doesn't have a channel context. Fix the crash by using
status->band and properly mark the return frame as an
off-channel frame.

Reported-by: Ilan Peer <[email protected]>
Reviewed-by: Ilan Peer <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>
---
net/mac80211/rx.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5b4492a..2528b5a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2666,7 +2666,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)

memset(nskb->cb, 0, sizeof(nskb->cb));

- ieee80211_tx_skb(rx->sdata, nskb);
+ if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
+
+ info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
+ IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
+ IEEE80211_TX_CTL_NO_CCK_RATE;
+ if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+ info->hw_queue =
+ local->hw.offchannel_tx_hw_queue;
+ }
+
+ __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
+ status->band);
}
dev_kfree_skb(rx->skb);
return RX_QUEUED;
--
1.8.0

2013-03-11 07:36:46

by Johannes Berg

Subject: Re: [PATCH] mac80211: fix crash with P2P Device returning action frames

On Fri, 2013-03-08 at 11:09 +0100, Johannes Berg wrote:
> From: Johannes Berg <[email protected]>
>
> If a P2P Device interface receives an unhandled action
> frame, we attempt to return it. This crashes because it
> doesn't have a channel context. Fix the crash by using
> status->band and properly mark the return frame as an
> off-channel frame.

Applied.

johannes