Commit b054b747 authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville
Browse files

mac80211: fix deauth before assoc 

When we receive a deauthentication frame before
having successfully associated, we neither print
a message nor abort assocation. The former makes
it hard to debug, while the latter later causes
a warning in cfg80211 when, as will typically be
the case, association timed out.

This warning was reported by many, e.g. in
https://bugzilla.kernel.org/show_bug.cgi?id=15981

,
but I couldn't initially pinpoint it. I verified
the fix by hacking hostapd to send a deauth frame
instead of an association response.

Cc: stable@kernel.org
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Tested-by: default avatarMiles Lane <miles.lane@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 6db6340c

net/mac80211/mlme.c

+38 −2
Original line number Original line Diff line number Diff line
@@ -1760,9 +1760,45 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, 
	mutex_unlock(&ifmgd->mtx);

	mutex_unlock(&ifmgd->mtx);





	if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&

	if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&

	    (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH)

	    (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) {

		cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);

		struct ieee80211_local *local = sdata->local;

		struct ieee80211_work *wk;



		mutex_lock(&local->work_mtx);

		list_for_each_entry(wk, &local->work_list, list) {

			if (wk->sdata != sdata)

				continue;



			if (wk->type != IEEE80211_WORK_ASSOC)

				continue;



			if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN))

				continue;

			if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN))

				continue;





			/*

			 * Printing the message only here means we can't

			 * spuriously print it, but it also means that it

			 * won't be printed when the frame comes in before

			 * we even tried to associate or in similar cases.

			 *

			 * Ultimately, I suspect cfg80211 should print the

			 * messages instead.

			 */

			printk(KERN_DEBUG

			       "%s: deauthenticated from %pM (Reason: %u)\n",

			       sdata->name, mgmt->bssid,

			       le16_to_cpu(mgmt->u.deauth.reason_code));



			list_del_rcu(&wk->list);

			free_work(wk);

			break;

		}

		mutex_unlock(&local->work_mtx);



		cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);

	}

 out:

 out:

	kfree_skb(skb);

	kfree_skb(skb);

}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE