From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Fredrik Olofsson <fredrik.olofsson@anyfinetworks.com>,
Johannes Berg <johannes.berg@intel.com>,
Sasha Levin <sashal@kernel.org>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 090/187] mac80211: fix TID field in monitor mode transmit
Date: Fri, 27 Dec 2019 12:39:18 -0500 [thread overview]
Message-ID: <20191227174055.4923-90-sashal@kernel.org> (raw)
In-Reply-To: <20191227174055.4923-1-sashal@kernel.org>
From: Fredrik Olofsson <fredrik.olofsson@anyfinetworks.com>
[ Upstream commit 753ffad3d6243303994227854d951ff5c70fa9e0 ]
Fix overwriting of the qos_ctrl.tid field for encrypted frames injected on
a monitor interface. While qos_ctrl.tid is not encrypted, it's used as an
input into the encryption algorithm so it's protected, and thus cannot be
modified after encryption. For injected frames, the encryption may already
have been done in userspace, so we cannot change any fields.
Before passing the frame to the driver, the qos_ctrl.tid field is updated
from skb->priority. Prior to dbd50a851c50 skb->priority was updated in
ieee80211_select_queue_80211(), but this function is no longer always
called.
Update skb->priority in ieee80211_monitor_start_xmit() so that the value
is stored, and when later code 'modifies' the TID it really sets it to
the same value as before, preserving the encryption.
Fixes: dbd50a851c50 ("mac80211: only allocate one queue when using iTXQs")
Signed-off-by: Fredrik Olofsson <fredrik.olofsson@anyfinetworks.com>
Link: https://lore.kernel.org/r/20191119133451.14711-1-fredrik.olofsson@anyfinetworks.com
[rewrite commit message based on our discussion]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/tx.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 1fa422782905..cbd273c0b275 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2263,6 +2263,15 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
payload[7]);
}
+ /*
+ * Initialize skb->priority for QoS frames. This is put in the TID field
+ * of the frame before passing it to the driver.
+ */
+ if (ieee80211_is_data_qos(hdr->frame_control)) {
+ u8 *p = ieee80211_get_qos_ctl(hdr);
+ skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
+ }
+
memset(info, 0, sizeof(*info));
info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
--
2.20.1
next prev parent reply other threads:[~2019-12-27 17:53 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20191227174055.4923-1-sashal@kernel.org>
2019-12-27 17:37 ` [PATCH AUTOSEL 5.4 008/187] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() Sasha Levin
2020-01-06 22:51 ` Brian Norris
2020-01-09 15:29 ` Sasha Levin
2020-01-09 17:33 ` Brian Norris
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 014/187] netfilter: ctnetlink: netns exit must wait for callbacks Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 017/187] netfilter: nf_tables_offload: Check for the NETDEV_UNREGISTER event Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 018/187] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 025/187] netfilter: nf_queue: enqueue skbs with NULL dst Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 033/187] netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 034/187] netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 035/187] netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 036/187] netfilter: nf_tables: skip module reference count bump on object updates Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 037/187] netfilter: nf_tables_offload: return EOPNOTSUPP if rule specifies no actions Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 038/187] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 049/187] mlxsw: spectrum_router: Remove unlikely user-triggerable warning Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 050/187] selftests: forwarding: Delete IPv6 address at the end Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 052/187] net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size" Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 053/187] af_packet: set defaule value for tmo Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 054/187] fjes: fix missed check in fjes_acpi_add Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 055/187] NFC: nxp-nci: Fix probing without ACPI Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 056/187] Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection" Sasha Levin
2019-12-30 5:48 ` Anders Kaseorg
2020-01-05 15:42 ` Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 057/187] iwlwifi: pcie: move power gating workaround earlier in the flow Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 067/187] bnxt_en: Fix MSIX request logic for RDMA driver Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 068/187] bnxt_en: Return error if FW returns more data than dump length Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 069/187] net: ena: fix napi handler misbehavior when the napi budget is zero Sasha Levin
2019-12-27 17:38 ` [PATCH AUTOSEL 5.4 071/187] bpf, riscv: Limit to 33 tail calls Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 072/187] bpf, mips: " Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 073/187] bpftool: Don't crash on missing jited insns or ksyms Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 080/187] samples: bpf: Replace symbol compare of trace_event Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 081/187] samples: bpf: fix syscall_tp due to unused syscall Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 087/187] net: usb: lan78xx: Fix suspend/resume PHY register access error Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 088/187] qede: Fix multicast mac configuration Sasha Levin
2019-12-27 17:39 ` Sasha Levin [this message]
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 091/187] cfg80211: fix double-free after changing network namespace Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 100/187] bpf: Clear skb->tstamp in bpf_redirect when necessary Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 101/187] bnxt: apply computed clamp value for coalece parameter Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 102/187] ipv6/addrconf: only check invalid header values when NETLINK_F_STRICT_CHK is set Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 103/187] tcp/dccp: fix possible race __inet_lookup_established() Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 104/187] 6pack,mkiss: fix possible deadlock Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 107/187] net: marvell: mvpp2: phylink requires the link interrupt Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 108/187] hv_netvsc: Fix tx_table init in rndis_set_subchannel() Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 109/187] bnx2x: Do not handle requests from VFs after parity Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 110/187] bnx2x: Fix logic to get total no. of PFs per engine Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 111/187] bonding: fix active-backup transition after link failure Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 112/187] gtp: do not allow adding duplicate tid and ms_addr pdp context Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 113/187] gtp: fix wrong condition in gtp_genl_dump_pdp() Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 114/187] gtp: fix an use-after-free in ipv4_pdp_find() Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 115/187] gtp: avoid zero size hashtable Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 116/187] net: phylink: fix interface passed to mac_link_up Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 117/187] net/smc: add fallback check to connect() Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 118/187] cxgb4: Fix kernel panic while accessing sge_info Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 119/187] net: usb: lan78xx: Fix error message format specifier Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 122/187] rfkill: Fix incorrect check to avoid NULL pointer dereference Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 128/187] net: dsa: b53: Fix egress flooding settings Sasha Levin
2019-12-27 17:39 ` [PATCH AUTOSEL 5.4 129/187] net: gemini: Fix memory leak in gmac_setup_txqs Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191227174055.4923-90-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=fredrik.olofsson@anyfinetworks.com \
--cc=johannes.berg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).