diff options
| author | Javier Cardona <javier@cozybit.com> | 2012-10-24 23:43:30 +0400 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2012-10-25 15:51:29 +0400 |
| commit | 555cb715be8ef98b8ec362b23dfc254d432a35b1 (patch) | |
| tree | 5749dd089c51771c0d60b7c7018f79abd79a9096 /net | |
| parent | 9690fb169b433a66485c808e4fc352b8a0f8d866 (diff) | |
| download | linux-555cb715be8ef98b8ec362b23dfc254d432a35b1.tar.xz | |
mac80211: Only process mesh config header on frames that RA_MATCH
Doing otherwise is wrong, and may wreak havoc on the mpp tables,
specially if the frame is encrypted.
Cc: stable@vger.kernel.org
Reported-by: Chaoxing Lin <Chaoxing.Lin@ultra-3eti.com>
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/rx.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 61c621e9273f..1222127de9be 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1897,7 +1897,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata)) return RX_DROP_MONITOR; - if (!ieee80211_is_data(hdr->frame_control)) + if (!ieee80211_is_data(hdr->frame_control) || + !(status->rx_flags & IEEE80211_RX_RA_MATCH)) return RX_CONTINUE; if (!mesh_hdr->ttl) @@ -1941,9 +1942,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) } skb_set_queue_mapping(skb, q); - if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) - goto out; - if (!--mesh_hdr->ttl) { IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); return RX_DROP_MONITOR; |