| From 05aaa5c97dce4c10a9e7eae2f1569a684e0c5ced Mon Sep 17 00:00:00 2001 |
| From: Brian Norris <briannorris@chromium.org> |
| Date: Fri, 26 Jul 2019 15:47:58 -0700 |
| Subject: mac80211: don't WARN on short WMM parameters from AP |
| |
| From: Brian Norris <briannorris@chromium.org> |
| |
| commit 05aaa5c97dce4c10a9e7eae2f1569a684e0c5ced upstream. |
| |
| In a very similar spirit to commit c470bdc1aaf3 ("mac80211: don't WARN |
| on bad WMM parameters from buggy APs"), an AP may not transmit a |
| fully-formed WMM IE. For example, it may miss or repeat an Access |
| Category. The above loop won't catch that and will instead leave one of |
| the four ACs zeroed out. This triggers the following warning in |
| drv_conf_tx() |
| |
| wlan0: invalid CW_min/CW_max: 0/0 |
| |
| and it may leave one of the hardware queues unconfigured. If we detect |
| such a case, let's just print a warning and fall back to the defaults. |
| |
| Tested with a hacked version of hostapd, intentionally corrupting the |
| IEs in hostapd_eid_wmm(). |
| |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Brian Norris <briannorris@chromium.org> |
| Link: https://lore.kernel.org/r/20190726224758.210953-1-briannorris@chromium.org |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/mac80211/mlme.c | 10 ++++++++++ |
| 1 file changed, 10 insertions(+) |
| |
| --- a/net/mac80211/mlme.c |
| +++ b/net/mac80211/mlme.c |
| @@ -1867,6 +1867,16 @@ static bool ieee80211_sta_wmm_params(str |
| } |
| } |
| |
| + /* WMM specification requires all 4 ACIs. */ |
| + for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { |
| + if (params[ac].cw_min == 0) { |
| + sdata_info(sdata, |
| + "AP has invalid WMM params (missing AC %d), using defaults\n", |
| + ac); |
| + return false; |
| + } |
| + } |
| + |
| for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { |
| mlme_dbg(sdata, |
| "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n", |
