mac80211: fix sta lookup with AP VLAN interfaces and injected frames

When injecting frames, mac80211 currently looks for the first AP
interface that matches the source address of the injected frame.
This breaks when such a frame is directed at a STA that has been moved
to a VLAN. This patch fixes it by using sta_info_get_bss instead of
sta_info_get, which also finds stations belonging to a VLAN interface
of the same BSS as the AP interface.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e7b1cdc7651b..85e382aa894e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1133,6 +1133,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                         return TX_DROP;
+        } else if (info->flags & IEEE80211_TX_CTL_INJECTED) {
+                tx->sta = sta_info_get_bss(sdata, hdr->addr1);
         }
         if (!tx->sta)
                 tx->sta = sta_info_get(sdata, hdr->addr1);