From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Javier Cardona <javier@cozybit.com>,
Javier Lopez <jlopex@cozybit.com>,
Johannes Berg <johannes.berg@intel.com>
Subject: [ 06/38] mac80211: dont inspect Sequence Control field on control frames
Date: Wed, 14 Nov 2012 20:10:03 -0800 [thread overview]
Message-ID: <20121115040933.298508356@linuxfoundation.org> (raw)
In-Reply-To: <20121115040932.918082372@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Cardona <javier@cozybit.com>
commit f7fbf70ee9db6da6033ae50d100e017ac1f26555 upstream.
Per IEEE Std. 802.11-2012, Sec 8.2.4.4.1, the sequence Control field is
not present in control frames. We noticed this problem when processing
Block Ack Requests.
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: Javier Lopez <jlopex@cozybit.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/rx.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1352,6 +1352,10 @@ ieee80211_rx_h_defragment(struct ieee802
hdr = (struct ieee80211_hdr *)rx->skb->data;
fc = hdr->frame_control;
+
+ if (ieee80211_is_ctl(fc))
+ return RX_CONTINUE;
+
sc = le16_to_cpu(hdr->seq_ctrl);
frag = sc & IEEE80211_SCTL_FRAG;
next prev parent reply other threads:[~2012-11-15 4:49 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-15 4:09 [ 00/38] 3.0.52-stable review Greg Kroah-Hartman
2012-11-15 4:09 ` [ 01/38] ath9k: fix stale pointers potentially causing access to freed skbs Greg Kroah-Hartman
2012-11-15 4:09 ` [ 02/38] rt2800: validate step value for temperature compensation Greg Kroah-Hartman
2012-11-15 4:10 ` [ 03/38] target: Dont return success from module_init() if setup fails Greg Kroah-Hartman
2012-11-15 4:10 ` [ 04/38] cfg80211: fix antenna gain handling Greg Kroah-Hartman
2012-11-15 4:10 ` [ 05/38] wireless: drop invalid mesh address extension frames Greg Kroah-Hartman
2012-11-15 4:10 ` Greg Kroah-Hartman [this message]
2012-11-15 4:10 ` [ 07/38] DRM/Radeon: Fix Load Detection on legacy primary DAC Greg Kroah-Hartman
2012-11-15 4:10 ` [ 08/38] mac80211: check management frame header length Greg Kroah-Hartman
2012-11-15 4:10 ` [ 09/38] mac80211: fix SSID copy on IBSS JOIN Greg Kroah-Hartman
2012-11-15 4:10 ` [ 10/38] nfsv3: Make v3 mounts fail with ETIMEDOUTs instead EIO on mountd timeouts Greg Kroah-Hartman
2012-11-15 4:10 ` [ 11/38] nfs: Show original device name verbatim in /proc/*/mount{s,info} Greg Kroah-Hartman
2012-11-15 4:10 ` [ 12/38] NFSv4: nfs4_locku_done must release the sequence id Greg Kroah-Hartman
2012-11-15 4:10 ` [ 13/38] nfsd: add get_uint for u32s Greg Kroah-Hartman
2012-11-15 4:10 ` [ 14/38] NFS: fix bug in legacy DNS resolver Greg Kroah-Hartman
2012-11-15 4:10 ` [ 15/38] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate Greg Kroah-Hartman
2012-11-15 4:10 ` [ 16/38] drm: restore open_count if drm_setup fails Greg Kroah-Hartman
2012-11-15 4:10 ` [ 17/38] hwmon: (w83627ehf) Force initial bank selection Greg Kroah-Hartman
2012-11-15 4:10 ` [ 18/38] ALSA: PCM: Fix some races at disconnection Greg Kroah-Hartman
2012-11-15 4:10 ` [ 19/38] ALSA: usb-audio: Fix " Greg Kroah-Hartman
2012-11-15 4:10 ` [ 20/38] ALSA: usb-audio: Use rwsem for disconnect protection Greg Kroah-Hartman
2012-11-15 4:10 ` [ 21/38] ALSA: usb-audio: Fix races at disconnection in mixer_quirks.c Greg Kroah-Hartman
2012-11-15 4:10 ` [ 22/38] ALSA: Add a reference counter to card instance Greg Kroah-Hartman
2012-11-15 4:10 ` [ 23/38] ALSA: Avoid endless sleep after disconnect Greg Kroah-Hartman
2012-11-15 4:10 ` [ 24/38] sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter() Greg Kroah-Hartman
2012-11-15 4:10 ` [ 25/38] netlink: use kfree_rcu() in netlink_release() Greg Kroah-Hartman
2012-11-15 4:10 ` [ 26/38] tcp: fix FIONREAD/SIOCINQ Greg Kroah-Hartman
2012-11-15 4:10 ` [ 27/38] ipv6: Set default hoplimit as zero Greg Kroah-Hartman
2012-11-15 4:10 ` [ 28/38] net: usb: Fix memory leak on Tx data path Greg Kroah-Hartman
2012-11-15 4:10 ` [ 29/38] net: fix divide by zero in tcp algorithm illinois Greg Kroah-Hartman
2012-11-15 4:10 ` [ 30/38] l2tp: fix oops in l2tp_eth_create() error path Greg Kroah-Hartman
2012-11-15 4:10 ` [ 31/38] ipv6: send unsolicited neighbour advertisements to all-nodes Greg Kroah-Hartman
2012-11-15 4:10 ` [ 32/38] futex: Handle futex_pi OWNER_DIED take over correctly Greg Kroah-Hartman
2012-11-15 4:10 ` [ 33/38] drm/vmwgfx: Fix hibernation device reset Greg Kroah-Hartman
2012-11-15 4:10 ` [ 34/38] drm/i915: fixup infoframe support for sdvo Greg Kroah-Hartman
2012-11-15 4:10 ` [ 35/38] drm/i915: clear the entire sdvo infoframe buffer Greg Kroah-Hartman
2012-11-15 4:10 ` [ 36/38] USB: mos7840: remove unused variable Greg Kroah-Hartman
2012-11-15 4:10 ` [ 37/38] xfs: fix reading of wrapped log data Greg Kroah-Hartman
2012-11-15 4:10 ` [ 38/38] intel-iommu: Fix AB-BA lockdep report Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121115040933.298508356@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=javier@cozybit.com \
--cc=jlopex@cozybit.com \
--cc=johannes.berg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.