aboutsummaryrefslogtreecommitdiff
path: root/net/mac80211/iface.c
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2010-01-11 06:47:00 +0100
committerJohn W. Linville <linville@tuxdriver.com>2010-01-11 19:37:09 -0500
commit193e70ef65a6c33f2935ce1f4adeb08ecb9202cf (patch)
treef079d1fe437bb9cd1f69ace985114e074c65a023 /net/mac80211/iface.c
parent39825f4dc9f4e409e8ea43ef4df04a924699ad1f (diff)
mac80211: fix queue selection for data frames on monitor interfaces
When ieee80211_monitor_select_queue encounters data frames, it selects the WMM AC based on skb->priority and assumes that skb->priority contains a valid 802.1d tag. However this assumption is incorrect, since ieee80211_select_queue has not been called at this point. If skb->priority > 7, an array overrun occurs, which could lead to invalid values, resulting in crashes in the tx path. Fix this by setting skb->priority based on the 802.11 header for QoS frames and using the default AC for all non-QoS frames. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/iface.c')
-rw-r--r--net/mac80211/iface.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d62ec0803be..32abae3ce32 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -670,6 +670,7 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
struct ieee80211_local *local = sdata->local;
struct ieee80211_hdr *hdr;
struct ieee80211_radiotap_header *rtap = (void *)skb->data;
+ u8 *p;
if (local->hw.queues < 4)
return 0;
@@ -680,12 +681,14 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
- if (!ieee80211_is_data(hdr->frame_control)) {
+ if (!ieee80211_is_data_qos(hdr->frame_control)) {
skb->priority = 7;
return ieee802_1d_to_ac[skb->priority];
}
- skb->priority = 0;
+ p = ieee80211_get_qos_ctl(hdr);
+ skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
+
return ieee80211_downgrade_queue(local, skb);
}