diff options
| author | Thomas Pedersen <thomas@cozybit.com> | 2011-11-03 21:11:12 -0700 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-11-09 16:05:48 -0500 |
| commit | 660c6a449a714cf770641134124f2aae49ed8ab0 (patch) | |
| tree | 63db5096b73dc8826a51b40b6696c2ffbf633306 /net/mac80211/rx.c | |
| parent | 6cc00d545a21ed26696f3bda865ebf11eccbf2b5 (diff) | |
| download | linux-3.10-660c6a449a714cf770641134124f2aae49ed8ab0.tar.gz linux-3.10-660c6a449a714cf770641134124f2aae49ed8ab0.tar.bz2 linux-3.10-660c6a449a714cf770641134124f2aae49ed8ab0.zip | |
mac80211: check if frame is really part of this BA
There was an an implicit assumption that any QoS data frame received
from a STA/TID with an active BA session was sent to this vif as part of
a BA. This is not true if IFF_PROMISC is enabled and the frame was
destined for a different peer, for example. Don't treat these frames as
part of a BA from the sending STA.
Signed-off-by: Thomas Pedersen <thomas@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/rx.c')
| -rw-r--r-- | net/mac80211/rx.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 72c1eb4eb45..04c1b05ba33 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -744,6 +744,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx) struct ieee80211_local *local = rx->local; struct ieee80211_hw *hw = &local->hw; struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; + struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); struct sta_info *sta = rx->sta; struct tid_ampdu_rx *tid_agg_rx; u16 sc; @@ -777,6 +778,10 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx) ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) goto dont_reorder; + /* not actually part of this BA session */ + if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) + goto dont_reorder; + /* new, potentially un-ordered, ampdu frame - process it */ /* reset session timer */ |