mac80211: add missing sanity checks for action frames

Various missing sanity checks caused rejected action frames to be
interpreted as channel switch announcements, which can cause a client
mode interface to switch away from its operating channel, thereby losing
connectivity. This patch ensures that only spectrum management action
frames are processed by the CSA handling function and prevents rejected
action frames from getting processed by the MLME code.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Cc: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 54296999834b..82a30c1bf3ab 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2015,6 +2015,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 }
                 break;
         default:
+                /* do not process rejected action frames */
+                if (mgmt->u.action.category & 0x80)
+                        return RX_DROP_MONITOR;
+
                 return RX_CONTINUE;
         }