diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2013-03-07 13:22:05 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2013-03-11 09:37:50 +0200 |
| commit | 07e5a5f5ab7474589c15fc5d88e4f7fc43979530 (patch) | |
| tree | 27f08edd2f94fd63390a136c15386c574ce1a83a | |
| parent | 1345ee6a6d90813f972379fad8b75f17026fc8b2 (diff) | |
| download | linux-07e5a5f5ab7474589c15fc5d88e4f7fc43979530.tar.gz linux-07e5a5f5ab7474589c15fc5d88e4f7fc43979530.tar.bz2 linux-07e5a5f5ab7474589c15fc5d88e4f7fc43979530.zip | |
mac80211: fix crash with P2P Device returning action frames
If a P2P Device interface receives an unhandled action
frame, we attempt to return it. This crashes because it
doesn't have a channel context. Fix the crash by using
status->band and properly mark the return frame as an
off-channel frame.
Reported-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/rx.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index bb73ed2d20b9..c6844ad080be 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -2675,7 +2675,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) memset(nskb->cb, 0, sizeof(nskb->cb)); - ieee80211_tx_skb(rx->sdata, nskb); + if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); + + info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | + IEEE80211_TX_INTFL_OFFCHAN_TX_OK | + IEEE80211_TX_CTL_NO_CCK_RATE; + if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) + info->hw_queue = + local->hw.offchannel_tx_hw_queue; + } + + __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, + status->band); } dev_kfree_skb(rx->skb); return RX_QUEUED; |