mac80211: fix RX sequence number check

According to 802.11-2007, we are doing the wrong thing in the
sequence number checks when receiving frames. This fixes it.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 12 insertions, 7 deletions

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index ba332c9dc19..6d9ae67c27c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -334,13 +334,18 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
                 else
                         rx->flags &= ~IEEE80211_RX_AMSDU;
         } else {
-                if (unlikely(ieee80211_is_mgmt(hdr->frame_control))) {
-                        /* Separate TID for management frames */
-                        tid = NUM_RX_DATA_QUEUES - 1;
-                } else {
-                        /* no qos control present */
-                        tid = 0; /* 802.1d - Best Effort */
-                }
+                /*
+                 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
+                 *
+                 *      Sequence numbers for management frames, QoS data
+                 *      frames with a broadcast/multicast address in the
+                 *      Address 1 field, and all non-QoS data frames sent
+                 *      by QoS STAs are assigned using an additional single
+                 *      modulo-4096 counter, [...]
+                 *
+                 * We also use that counter for non-QoS STAs.
+                 */
+                tid = NUM_RX_DATA_QUEUES - 1;
         }
 
         rx->queue = tid;