diff options
| author | David S. Miller <davem@davemloft.net> | 2016-09-18 22:26:49 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-09-18 22:26:49 -0400 |
| commit | 7ac327318e09a53e3df431dfd3f664dac7aba4df (patch) | |
| tree | 92487d063cb1fcc5523682383484bf4613a1f65e /net | |
| parent | 19cd120319ef5390404a5d9c829c3a7962f184a8 (diff) | |
| parent | 85d5313ed717ad60769491c7c072d23bc0a68e7a (diff) | |
| download | linux-0-day-7ac327318e09a53e3df431dfd3f664dac7aba4df.tar.gz linux-0-day-7ac327318e09a53e3df431dfd3f664dac7aba4df.tar.xz | |
Merge tag 'mac80211-for-davem-2016-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
Johannes Berg says:
====================
Two more fixes:
* reject aggregation sessions for TSID/TID 8-16 that we
can never use anyway and which could confuse drivers
* check return value of skb_linearize()
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/agg-rx.c | 8 | ||||
| -rw-r--r-- | net/mac80211/agg-tx.c | 3 | ||||
| -rw-r--r-- | net/mac80211/tx.c | 8 |
3 files changed, 16 insertions, 3 deletions
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c index a9aff6079c42a..afa94687d5e15 100644 --- a/net/mac80211/agg-rx.c +++ b/net/mac80211/agg-rx.c @@ -261,10 +261,16 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta, .timeout = timeout, .ssn = start_seq_num, }; - int i, ret = -EOPNOTSUPP; u16 status = WLAN_STATUS_REQUEST_DECLINED; + if (tid >= IEEE80211_FIRST_TSPEC_TSID) { + ht_dbg(sta->sdata, + "STA %pM requests BA session on unsupported tid %d\n", + sta->sta.addr, tid); + goto end_no_lock; + } + if (!sta->sta.ht_cap.ht_supported) { ht_dbg(sta->sdata, "STA %pM erroneously requests BA session on tid %d w/o QoS\n", diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c index 5650c46bf91a6..45319cc01121a 100644 --- a/net/mac80211/agg-tx.c +++ b/net/mac80211/agg-tx.c @@ -584,6 +584,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid, ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW)) return -EINVAL; + if (WARN_ON(tid >= IEEE80211_FIRST_TSPEC_TSID)) + return -EINVAL; + ht_dbg(sdata, "Open BA session requested for %pM tid %u\n", pubsta->addr, tid); diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index cc8e95554b488..18b285e06bc89 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1515,8 +1515,12 @@ out: spin_unlock_bh(&fq->lock); if (skb && skb_has_frag_list(skb) && - !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) - skb_linearize(skb); + !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) { + if (skb_linearize(skb)) { + ieee80211_free_txskb(&local->hw, skb); + return NULL; + } + } return skb; } |