From 353d09c6ceedc1cb0c54fe5002c0ca80b6ee6e4f Mon Sep 17 00:00:00 2001 From: Christian Lamparter Date: Sat, 7 Jul 2012 15:07:13 +0200 Subject: mac80211: fix read outside array bounds ieee802_1d_to_ac is defined as a const int[8], but the tid parameter has a range from 0 to 15. Cc: stable@vger.kernel.org Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville --- net/mac80211/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net/mac80211') diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index e453212fa17..85cf32d2f7b 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -2733,7 +2733,7 @@ EXPORT_SYMBOL(ieee80211_get_buffered_bc); void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb, int tid) { - int ac = ieee802_1d_to_ac[tid]; + int ac = ieee802_1d_to_ac[tid & 7]; skb_set_mac_header(skb, 0); skb_set_network_header(skb, 0); -- cgit v1.2.3-70-g09d2 From 7c41f3159ca4f04dfc22c791fd96d3d057dcaf90 Mon Sep 17 00:00:00 2001 From: Chun-Yeow Yeoh Date: Wed, 11 Jul 2012 16:28:21 +0800 Subject: mac80211: Fix the Problem of Unreachable Mesh STA from DS This patch fixes the problem of unreachable mesh STA from Distribution System (DS) due to the introduction of previous patch solving the mesh STA joining from one MBSS to another MBSS. Reported-by: Georgiewskiy Yuriy Signed-off-by: Chun-Yeow Yeoh Signed-off-by: John W. Linville --- net/mac80211/tx.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'net/mac80211') diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 85cf32d2f7b..eab0d19eb4b 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1836,6 +1836,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb, /* RA TA mDA mSA AE:DA SA */ mesh_da = mppath->mpp; is_mesh_mcast = 0; + } else if (mpath) { + mesh_da = mpath->dst; + is_mesh_mcast = 0; } else { /* DA TA mSA AE:SA */ mesh_da = bcast; -- cgit v1.2.3-70-g09d2