xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mac80211: parse radiotap header when selecting Tx queue

Browse Source 
Already parse the radiotap header in ieee80211_monitor_select_queue.
In a subsequent commit this will allow us to add a radiotap flag that
influences the queue on which injected packets will be sent.

This also fixes the incomplete validation of the injected frame in
ieee80211_monitor_select_queue: currently an out of bounds memory
access may occur in in the called function ieee80211_select_queue_80211
if the 802.11 header is too small.

Note that in ieee80211_monitor_start_xmit the radiotap header is parsed
again, which is necessairy because ieee80211_monitor_select_queue is not
always called beforehand.

Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://lore.kernel.org/r/20200723100153.31631-6-Mathy.Vanhoef@kuleuven.be
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Mathy Vanhoef
2020-07-23 14:01:53 +04:00
committed by Johannes Berg
parent 08aca29aa8
commit cb17ed29a7
3 changed files with 43 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/net/mac80211.h
View File

@@ -6238,6 +6238,14 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
struct ieee80211_vif *vif, struct sk_buff *skb,
int band, struct ieee80211_sta **sta);
/**
* Sanity-check and parse the radiotap header of injected frames
* @skb: packet injected by userspace
* @dev: the &struct device of this 802.11 device
*/
bool ieee80211_parse_tx_radiotap(struct sk_buff *skb,
struct net_device *dev);
/**
* struct ieee80211_noa_data - holds temporary data for tracking P2P NoA state
*