Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 555cb715 authored by Javier Cardona's avatar Javier Cardona Committed by Johannes Berg
Browse files

mac80211: Only process mesh config header on frames that RA_MATCH 



Doing otherwise is wrong, and may wreak havoc on the mpp tables,
specially if the frame is encrypted.

Cc: stable@vger.kernel.org
Reported-by: default avatarChaoxing Lin <Chaoxing.Lin@ultra-3eti.com>
Signed-off-by: default avatarJavier Cardona <javier@cozybit.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 9690fb16

net/mac80211/rx.c

+2 −4
Original line number Original line Diff line number Diff line
@@ -1897,7 +1897,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 
	    mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))

	    mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))

		return RX_DROP_MONITOR;

		return RX_DROP_MONITOR;





	if (!ieee80211_is_data(hdr->frame_control))

	if (!ieee80211_is_data(hdr->frame_control) ||

	    !(status->rx_flags & IEEE80211_RX_RA_MATCH))

		return RX_CONTINUE;

		return RX_CONTINUE;





	if (!mesh_hdr->ttl)

	if (!mesh_hdr->ttl)
@@ -1941,9 +1942,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 
	}

	}

	skb_set_queue_mapping(skb, q);

	skb_set_queue_mapping(skb, q);





	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))

		goto out;



	if (!--mesh_hdr->ttl) {

	if (!--mesh_hdr->ttl) {

		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);

		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);

		return RX_DROP_MONITOR;

		return RX_DROP_MONITOR;