* mac80211: fix queue selection for data frames on monitor interfaces
@ 2010-01-11 5:47 Felix Fietkau
2010-01-11 16:03 ` Luis R. Rodriguez
2010-01-12 9:37 ` Lennert Buytenhek
0 siblings, 2 replies; 6+ messages in thread
From: Felix Fietkau @ 2010-01-11 5:47 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg, John W. Linville
When ieee80211_monitor_select_queue encounters data frames, it selects
the WMM AC based on skb->priority and assumes that skb->priority
contains a valid 802.1d tag. However this assumption is incorrect, since
ieee80211_select_queue has not been called at this point.
If skb->priority > 7, an array overrun occurs, which could lead to
invalid values, resulting in crashes in the tx path.
Fix this by setting skb->priority based on the 802.11 header for QoS
frames and using the default AC for all non-QoS frames.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
---
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -685,6 +685,7 @@ static u16 ieee80211_monitor_select_queu
struct ieee80211_local *local = sdata->local;
struct ieee80211_hdr *hdr;
struct ieee80211_radiotap_header *rtap = (void *)skb->data;
+ u8 *p;
if (local->hw.queues < 4)
return 0;
@@ -695,11 +696,14 @@ static u16 ieee80211_monitor_select_queu
hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
- if (!ieee80211_is_data(hdr->frame_control)) {
+ if (!ieee80211_is_data_qos(hdr->frame_control)) {
skb->priority = 7;
return ieee802_1d_to_ac[skb->priority];
}
+ p = ieee80211_get_qos_ctl(hdr);
+ skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
+
return ieee80211_downgrade_queue(local, skb);
}
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: mac80211: fix queue selection for data frames on monitor interfaces
2010-01-11 5:47 mac80211: fix queue selection for data frames on monitor interfaces Felix Fietkau
@ 2010-01-11 16:03 ` Luis R. Rodriguez
2010-01-12 3:02 ` Felix Fietkau
2010-01-12 9:37 ` Lennert Buytenhek
1 sibling, 1 reply; 6+ messages in thread
From: Luis R. Rodriguez @ 2010-01-11 16:03 UTC (permalink / raw)
To: Felix Fietkau; +Cc: linux-wireless, Johannes Berg, John W. Linville
On Sun, Jan 10, 2010 at 9:47 PM, Felix Fietkau <nbd@openwrt.org> wrote:
> When ieee80211_monitor_select_queue encounters data frames, it selects
> the WMM AC based on skb->priority and assumes that skb->priority
> contains a valid 802.1d tag. However this assumption is incorrect, since
> ieee80211_select_queue has not been called at this point.
> If skb->priority > 7, an array overrun occurs, which could lead to
> invalid values, resulting in crashes in the tx path.
> Fix this by setting skb->priority based on the 802.11 header for QoS
> frames and using the default AC for all non-QoS frames.
>
> Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Its unclear whether or not this is a stable fix. It fixes a crash but
does this depend on a patch added recently which is not in stable yet?
Luis
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: mac80211: fix queue selection for data frames on monitor interfaces
2010-01-11 16:03 ` Luis R. Rodriguez
@ 2010-01-12 3:02 ` Felix Fietkau
0 siblings, 0 replies; 6+ messages in thread
From: Felix Fietkau @ 2010-01-12 3:02 UTC (permalink / raw)
To: Luis R. Rodriguez; +Cc: linux-wireless, Johannes Berg, John W. Linville
On 2010-01-11 5:03 PM, Luis R. Rodriguez wrote:
> On Sun, Jan 10, 2010 at 9:47 PM, Felix Fietkau <nbd@openwrt.org> wrote:
>> When ieee80211_monitor_select_queue encounters data frames, it selects
>> the WMM AC based on skb->priority and assumes that skb->priority
>> contains a valid 802.1d tag. However this assumption is incorrect, since
>> ieee80211_select_queue has not been called at this point.
>> If skb->priority > 7, an array overrun occurs, which could lead to
>> invalid values, resulting in crashes in the tx path.
>> Fix this by setting skb->priority based on the 802.11 header for QoS
>> frames and using the default AC for all non-QoS frames.
>>
>> Signed-off-by: Felix Fietkau <nbd@openwrt.org>
>
> Its unclear whether or not this is a stable fix. It fixes a crash but
> does this depend on a patch added recently which is not in stable yet?
It depends on the pile of tx queue fixes, and the crash doesn't exist
without those.
- Felix
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: mac80211: fix queue selection for data frames on monitor interfaces
2010-01-11 5:47 mac80211: fix queue selection for data frames on monitor interfaces Felix Fietkau
2010-01-11 16:03 ` Luis R. Rodriguez
@ 2010-01-12 9:37 ` Lennert Buytenhek
2010-01-12 11:51 ` Felix Fietkau
1 sibling, 1 reply; 6+ messages in thread
From: Lennert Buytenhek @ 2010-01-12 9:37 UTC (permalink / raw)
To: Felix Fietkau; +Cc: linux-wireless, Johannes Berg, John W. Linville
On Mon, Jan 11, 2010 at 06:47:00AM +0100, Felix Fietkau wrote:
> When ieee80211_monitor_select_queue encounters data frames, it selects
> the WMM AC based on skb->priority and assumes that skb->priority
> contains a valid 802.1d tag. However this assumption is incorrect, since
> ieee80211_select_queue has not been called at this point.
> If skb->priority > 7, an array overrun occurs, which could lead to
> invalid values, resulting in crashes in the tx path.
What you describe here was already reported and fixed:
http://marc.info/?l=linux-wireless&m=126287290723244&w=2
http://git.kernel.org/?p=linux/kernel/git/linville/wireless-2.6.git;a=commit;h=045cfb71a3901005bf6dcedae98cecb3360a0bfc
Your commit message could at least acknowledge this. I.e. write
that the existing fix doesn't handle QoS data frames in the optimal
way, and then mention this:
> Fix this by setting skb->priority based on the 802.11 header for QoS
> frames and using the default AC for all non-QoS frames.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: mac80211: fix queue selection for data frames on monitor interfaces
2010-01-12 9:37 ` Lennert Buytenhek
@ 2010-01-12 11:51 ` Felix Fietkau
2010-01-12 16:51 ` Luis R. Rodriguez
0 siblings, 1 reply; 6+ messages in thread
From: Felix Fietkau @ 2010-01-12 11:51 UTC (permalink / raw)
To: Lennert Buytenhek; +Cc: linux-wireless, Johannes Berg, John W. Linville
On 2010-01-12 10:37 AM, Lennert Buytenhek wrote:
> On Mon, Jan 11, 2010 at 06:47:00AM +0100, Felix Fietkau wrote:
>
>> When ieee80211_monitor_select_queue encounters data frames, it selects
>> the WMM AC based on skb->priority and assumes that skb->priority
>> contains a valid 802.1d tag. However this assumption is incorrect, since
>> ieee80211_select_queue has not been called at this point.
>> If skb->priority > 7, an array overrun occurs, which could lead to
>> invalid values, resulting in crashes in the tx path.
>
> What you describe here was already reported and fixed:
>
> http://marc.info/?l=linux-wireless&m=126287290723244&w=2
> http://git.kernel.org/?p=linux/kernel/git/linville/wireless-2.6.git;a=commit;h=045cfb71a3901005bf6dcedae98cecb3360a0bfc
>
> Your commit message could at least acknowledge this. I.e. write
> that the existing fix doesn't handle QoS data frames in the optimal
> way, and then mention this:
Sorry, when I wrote and posted the patch, I hadn't seen your previous
fix yet, because I was apparently looking at the wrong tree and had not
noticed your submission yet.
It only cleanly applied to a tree without your change, but it seems that
John fixed it up and replaced your fix with it anyway.
- Felix
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: mac80211: fix queue selection for data frames on monitor interfaces
2010-01-12 11:51 ` Felix Fietkau
@ 2010-01-12 16:51 ` Luis R. Rodriguez
0 siblings, 0 replies; 6+ messages in thread
From: Luis R. Rodriguez @ 2010-01-12 16:51 UTC (permalink / raw)
To: Felix Fietkau
Cc: Lennert Buytenhek, linux-wireless, Johannes Berg,
John W. Linville
On Tue, Jan 12, 2010 at 3:51 AM, Felix Fietkau <nbd@openwrt.org> wrote:
> On 2010-01-12 10:37 AM, Lennert Buytenhek wrote:
>> On Mon, Jan 11, 2010 at 06:47:00AM +0100, Felix Fietkau wrote:
>>
>>> When ieee80211_monitor_select_queue encounters data frames, it selects
>>> the WMM AC based on skb->priority and assumes that skb->priority
>>> contains a valid 802.1d tag. However this assumption is incorrect, since
>>> ieee80211_select_queue has not been called at this point.
>>> If skb->priority > 7, an array overrun occurs, which could lead to
>>> invalid values, resulting in crashes in the tx path.
>>
>> What you describe here was already reported and fixed:
>>
>> http://marc.info/?l=linux-wireless&m=126287290723244&w=2
>> http://git.kernel.org/?p=linux/kernel/git/linville/wireless-2.6.git;a=commit;h=045cfb71a3901005bf6dcedae98cecb3360a0bfc
>>
>> Your commit message could at least acknowledge this. I.e. write
>> that the existing fix doesn't handle QoS data frames in the optimal
>> way, and then mention this:
> Sorry, when I wrote and posted the patch, I hadn't seen your previous
> fix yet, because I was apparently looking at the wrong tree and had not
> noticed your submission yet.
> It only cleanly applied to a tree without your change, but it seems that
> John fixed it up and replaced your fix with it anyway.
John, did the new changes by Felix get marked for stable too? From
what I gather they apply on top of each other and are stable material.
Luis
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-01-12 16:51 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-01-11 5:47 mac80211: fix queue selection for data frames on monitor interfaces Felix Fietkau
2010-01-11 16:03 ` Luis R. Rodriguez
2010-01-12 3:02 ` Felix Fietkau
2010-01-12 9:37 ` Lennert Buytenhek
2010-01-12 11:51 ` Felix Fietkau
2010-01-12 16:51 ` Luis R. Rodriguez
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).