Commit d7907448 authored by Felix Fietkau's avatar Felix Fietkau Committed by John W. Linville

mac80211: add missing sanity checks for action frames

Various missing sanity checks caused rejected action frames to be
interpreted as channel switch announcements, which can cause a client
mode interface to switch away from its operating channel, thereby losing
connectivity. This patch ensures that only spectrum management action
frames are processed by the CSA handling function and prevents rejected
action frames from getting processed by the MLME code.
Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
Cc: stable@kernel.org
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 045cfb71
...@@ -1963,7 +1963,9 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, ...@@ -1963,7 +1963,9 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len); rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
break; break;
case IEEE80211_STYPE_ACTION: case IEEE80211_STYPE_ACTION:
/* XXX: differentiate, can only happen for CSA now! */ if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
break;
ieee80211_sta_process_chanswitch(sdata, ieee80211_sta_process_chanswitch(sdata,
&mgmt->u.action.u.chan_switch.sw_elem, &mgmt->u.action.u.chan_switch.sw_elem,
ifmgd->associated); ifmgd->associated);
......
...@@ -2015,6 +2015,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx) ...@@ -2015,6 +2015,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
} }
break; break;
default: default:
/* do not process rejected action frames */
if (mgmt->u.action.category & 0x80)
return RX_DROP_MONITOR;
return RX_CONTINUE; return RX_CONTINUE;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment