Commit 6b0f3274 authored Jul 11, 2013 by Johannes Berg

mac80211: fix duplicate retransmission detection



The duplicate retransmission detection code in mac80211
erroneously attempts to do the check for every frame,
even frames that don't have a sequence control field or
that don't use it (QoS-Null frames.)

This is problematic because it causes the code to access
data beyond the end of the SKB and depending on the data
there will drop packets erroneously.

Correct the code to not do duplicate detection for such
frames.

I found this error while testing AP powersave, it lead
to retransmitted PS-Poll frames being dropped entirely
as the data beyond the end of the SKB was always zero.

Cc: stable@vger.kernel.org [all versions]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent 83374fe9

net/mac80211/rx.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
		struct ieee80211_hdr hdr = (struct ieee80211_hdr )rx->skb->data;
		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);

		/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
		if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
		/*
		* Drop duplicate 802.11 retransmissions
		* (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
		*/
		if (rx->skb->len >= 24 && rx->sta &&
		!ieee80211_is_ctl(hdr->frame_control) &&
		!ieee80211_is_qos_nullfunc(hdr->frame_control) &&
		!is_multicast_ether_addr(hdr->addr1)) {
		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
		rx->sta->last_seq_ctrl[rx->seqno_idx] ==
		hdr->seq_ctrl)) {

Admin message