mac80211: add missing sanity checks for action frames (d7907448) · Commits · 戴 / test

Various missing sanity checks caused rejected action frames to be interpreted as channel switch announcements, which can cause a client mode interface to switch away from its operating channel, thereby losing connectivity. This patch ensures that only spectrum management action frames are processed by the CSA handling function and prevents rejected action frames from getting processed by the MLME code. Signed-off-by:

Felix Fietkau <nbd@openwrt.org> Cc: stable@kernel.org Signed-off-by:

John W. Linville <linville@tuxdriver.com>

net/mac80211/mlme.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1963,7 +1963,9 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
	rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);		rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
	break;		break;
	case IEEE80211_STYPE_ACTION:		case IEEE80211_STYPE_ACTION:
	/* XXX: differentiate, can only happen for CSA now! */		if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
			break;

	ieee80211_sta_process_chanswitch(sdata,		ieee80211_sta_process_chanswitch(sdata,
	&mgmt->u.action.u.chan_switch.sw_elem,		&mgmt->u.action.u.chan_switch.sw_elem,
	ifmgd->associated);		ifmgd->associated);

net/mac80211/rx.c

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -2015,6 +2015,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
	}		}
	break;		break;
	default:		default:
			/* do not process rejected action frames */
			if (mgmt->u.action.category & 0x80)
			return RX_DROP_MONITOR;

	return RX_CONTINUE;		return RX_CONTINUE;
	}		}

Admin message