[PATCH 1/2] mac80211: fix read outside array bounds

[PATCH 1/2] mac80211: fix read outside array bounds

[Christian Lamparter]

ieee802_1d_to_ac is defined as a const int[8],
but the tid parameter has a range from 0 to 15.

Cc: stable@vger.kernel.org
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
IMHO the patch should be correct, although it's been a while.
---
 net/mac80211/tx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d2e8159..3e974f2 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2717,7 +2717,7 @@ EXPORT_SYMBOL(ieee80211_get_buffered_bc);
 void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
 			  struct sk_buff *skb, int tid)
 {
-	int ac = ieee802_1d_to_ac[tid];
+	int ac = ieee802_1d_to_ac[tid & 7];
 
 	skb_set_mac_header(skb, 0);
 	skb_set_network_header(skb, 0);
-- 
1.7.10

[PATCH 2/2] mac80211: request TX status for BlockAck Requests

[Christian Lamparter]

Because ieee80211_tx_status in status.c checks if
outgoing BlockAck requests have been acked, it is
necessary to tell the driver that tx feedback for
this sort of frame is important.

Otherwise, the stack will continue to send the same
BlockAck request over and over, which can cause
the receiver to flush or clean its reorder buffer
over and over.

Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
AFAICT no driver will be really affected by this patch since
either the TX status is always reported anyway or not at all.

BTW: ieee80211_tx_skb_tid is used by a few other agg functions
(mostly addba/delba), so maybe it would make sense to do the
same there.
---
 net/mac80211/agg-tx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 5cc1bf7..0eaf245 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -135,7 +135,8 @@ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
 	bar->control = cpu_to_le16(bar_control);
 	bar->start_seq_num = cpu_to_le16(ssn);
 
-	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+		IEEE80211_TX_CTL_REQ_TX_STATUS;
 	ieee80211_tx_skb_tid(sdata, skb, tid);
 }
 EXPORT_SYMBOL(ieee80211_send_bar);
-- 
1.7.10

Re: [PATCH 1/2] mac80211: fix read outside array bounds

[Johannes Berg]

On Sat, 2012-07-07 at 15:07 +0200, Christian Lamparter wrote:
> ieee802_1d_to_ac is defined as a const int[8],
> but the tid parameter has a range from 0 to 15.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
> ---
> IMHO the patch should be correct, although it's been a while.

It looks necessary. I'd say it shouldn't be needed for stable, but it
seems safer because we could get incoming frames with TIDs that we don't
support I guess?

It's not really "correct", but as we don't support TIDs 8-15 anyway it
doesn't matter.

John, can you apply it please?

johannes

Re: [PATCH 2/2] mac80211: request TX status for BlockAck Requests

[Johannes Berg]

On Sat, 2012-07-07 at 15:13 +0200, Christian Lamparter wrote:
> Because ieee80211_tx_status in status.c checks if
> outgoing BlockAck requests have been acked, it is
> necessary to tell the driver that tx feedback for
> this sort of frame is important.
> 
> Otherwise, the stack will continue to send the same
> BlockAck request over and over, which can cause
> the receiver to flush or clean its reorder buffer
> over and over.
> 
> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
> ---
> AFAICT no driver will be really affected by this patch since
> either the TX status is always reported anyway or not at all.
> 
> BTW: ieee80211_tx_skb_tid is used by a few other agg functions
> (mostly addba/delba), so maybe it would make sense to do the
> same there.

Applied.

johannes