Commit 193e70ef authored Jan 11, 2010 by Felix Fietkau Committed by John W. Linville Jan 11, 2010

mac80211: fix queue selection for data frames on monitor interfaces



When ieee80211_monitor_select_queue encounters data frames, it selects
the WMM AC based on skb->priority and assumes that skb->priority
contains a valid 802.1d tag. However this assumption is incorrect, since
ieee80211_select_queue has not been called at this point.
If skb->priority > 7, an array overrun occurs, which could lead to
invalid values, resulting in crashes in the tx path.
Fix this by setting skb->priority based on the 802.11 header for QoS
frames and using the default AC for all non-QoS frames.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent 39825f4d

net/mac80211/iface.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -670,6 +670,7 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
		struct ieee80211_local *local = sdata->local;
		struct ieee80211_hdr *hdr;
		struct ieee80211_radiotap_header rtap = (void )skb->data;
		u8 *p;

		if (local->hw.queues < 4)
		return 0;
		@@ -680,12 +681,14 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,

		hdr = (void )((u8 )skb->data + le16_to_cpu(rtap->it_len));

		if (!ieee80211_is_data(hdr->frame_control)) {
		if (!ieee80211_is_data_qos(hdr->frame_control)) {
		skb->priority = 7;
		return ieee802_1d_to_ac[skb->priority];
		}

		skb->priority = 0;
		p = ieee80211_get_qos_ctl(hdr);
		skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;

		return ieee80211_downgrade_queue(local, skb);
		}

Admin message