diff options
| author | Javier Cardona <javier@cozybit.com> | 2012-10-24 12:43:30 -0700 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2012-11-16 16:46:56 +0000 |
| commit | e39761ee8faf2e80dc4ad22bfac43a122d9fd3a8 (patch) | |
| tree | 9a8d66e4fc1ddee8a7e58fee2986e114c30a9978 /net | |
| parent | c5cb6b2df5fa914f57a36b7b03b01a4d9d29030f (diff) | |
mac80211: Only process mesh config header on frames that RA_MATCH
commit 555cb715be8ef98b8ec362b23dfc254d432a35b1 upstream.
Doing otherwise is wrong, and may wreak havoc on the mpp tables,
specially if the frame is encrypted.
Reported-by: Chaoxing Lin <Chaoxing.Lin@ultra-3eti.com>
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.2: we have a large block conditional on
IEEE80211_RX_RA_MATCH rather than a goto conditional on the opposite,
so delete the condition]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/rx.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index cda48753ae48..c2172749896c 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1895,7 +1895,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata)) return RX_DROP_MONITOR; - if (!ieee80211_is_data(hdr->frame_control)) + if (!ieee80211_is_data(hdr->frame_control) || + !(status->rx_flags & IEEE80211_RX_RA_MATCH)) return RX_CONTINUE; if (!mesh_hdr->ttl) @@ -1941,7 +1942,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) mesh_hdr->ttl--; - if (status->rx_flags & IEEE80211_RX_RA_MATCH) { + { if (!mesh_hdr->ttl) IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh, dropped_frames_ttl); |