aboutsummaryrefslogtreecommitdiffstats
path: root/net/mac80211
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2010-01-07 14:23:53 -0500
committerJohn W. Linville <linville@tuxdriver.com>2010-01-08 15:49:28 -0500
commitd79074488083ec0d7ecd15352192dc1631f25643 (patch)
tree3ba73d537ca84153bc6412bf5b9fdcdf1e3e56b9 /net/mac80211
parent045cfb71a3901005bf6dcedae98cecb3360a0bfc (diff)
mac80211: add missing sanity checks for action frames
Various missing sanity checks caused rejected action frames to be interpreted as channel switch announcements, which can cause a client mode interface to switch away from its operating channel, thereby losing connectivity. This patch ensures that only spectrum management action frames are processed by the CSA handling function and prevents rejected action frames from getting processed by the MLME code. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211')
-rw-r--r--net/mac80211/mlme.c4
-rw-r--r--net/mac80211/rx.c4
2 files changed, 7 insertions, 1 deletions
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 3e1eab963b8e..05a18f43e1bf 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1963,7 +1963,9 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1963 rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len); 1963 rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
1964 break; 1964 break;
1965 case IEEE80211_STYPE_ACTION: 1965 case IEEE80211_STYPE_ACTION:
1966 /* XXX: differentiate, can only happen for CSA now! */ 1966 if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
1967 break;
1968
1967 ieee80211_sta_process_chanswitch(sdata, 1969 ieee80211_sta_process_chanswitch(sdata,
1968 &mgmt->u.action.u.chan_switch.sw_elem, 1970 &mgmt->u.action.u.chan_switch.sw_elem,
1969 ifmgd->associated); 1971 ifmgd->associated);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 54296999834b..82a30c1bf3ab 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2015,6 +2015,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2015 } 2015 }
2016 break; 2016 break;
2017 default: 2017 default:
2018 /* do not process rejected action frames */
2019 if (mgmt->u.action.category & 0x80)
2020 return RX_DROP_MONITOR;
2021
2018 return RX_CONTINUE; 2022 return RX_CONTINUE;
2019 } 2023 }
2020 2024