diff options
| author | Felix Fietkau <nbd@openwrt.org> | 2010-01-11 05:47:00 (GMT) |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-01-12 00:37:09 (GMT) |
| commit | 193e70ef65a6c33f2935ce1f4adeb08ecb9202cf (patch) | |
| tree | f079d1fe437bb9cd1f69ace985114e074c65a023 | |
| parent | 39825f4dc9f4e409e8ea43ef4df04a924699ad1f (diff) | |
| download | linux-193e70ef65a6c33f2935ce1f4adeb08ecb9202cf.tar.xz | |
mac80211: fix queue selection for data frames on monitor interfaces
When ieee80211_monitor_select_queue encounters data frames, it selects
the WMM AC based on skb->priority and assumes that skb->priority
contains a valid 802.1d tag. However this assumption is incorrect, since
ieee80211_select_queue has not been called at this point.
If skb->priority > 7, an array overrun occurs, which could lead to
invalid values, resulting in crashes in the tx path.
Fix this by setting skb->priority based on the 802.11 header for QoS
frames and using the default AC for all non-QoS frames.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | net/mac80211/iface.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index d62ec08..32abae3 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -670,6 +670,7 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev, struct ieee80211_local *local = sdata->local; struct ieee80211_hdr *hdr; struct ieee80211_radiotap_header *rtap = (void *)skb->data; + u8 *p; if (local->hw.queues < 4) return 0; @@ -680,12 +681,14 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev, hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len)); - if (!ieee80211_is_data(hdr->frame_control)) { + if (!ieee80211_is_data_qos(hdr->frame_control)) { skb->priority = 7; return ieee802_1d_to_ac[skb->priority]; } - skb->priority = 0; + p = ieee80211_get_qos_ctl(hdr); + skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK; + return ieee80211_downgrade_queue(local, skb); } |