Commit 05aaa5c9 authored Jul 26, 2019 by Brian Norris Committed by Johannes Berg Jul 29, 2019

mac80211: don't WARN on short WMM parameters from AP



In a very similar spirit to commit c470bdc1 ("mac80211: don't WARN
on bad WMM parameters from buggy APs"), an AP may not transmit a
fully-formed WMM IE. For example, it may miss or repeat an Access
Category. The above loop won't catch that and will instead leave one of
the four ACs zeroed out. This triggers the following warning in
drv_conf_tx()

  wlan0: invalid CW_min/CW_max: 0/0

and it may leave one of the hardware queues unconfigured. If we detect
such a case, let's just print a warning and fall back to the defaults.

Tested with a hacked version of hostapd, intentionally corrupting the
IEs in hostapd_eid_wmm().

Cc: stable@vger.kernel.org
Signed-off-by: Brian Norris <briannorris@chromium.org>
Link: https://lore.kernel.org/r/20190726224758.210953-1-briannorris@chromium.org


Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent e6f40511

net/mac80211/mlme.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -2042,6 +2042,16 @@ ieee80211_sta_wmm_params(struct ieee80211_local *local,
		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
		}

		/* WMM specification requires all 4 ACIs. */
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		if (params[ac].cw_min == 0) {
		sdata_info(sdata,
		"AP has invalid WMM params (missing AC %d), using defaults\n",
		ac);
		return false;
		}
		}

		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		mlme_dbg(sdata,
		"WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",

Admin message