Ticket #921: madwifi_monitor_invalid_frames_2.patch

net80211/ieee80211_monitor.c

@@ -319 +319 @@
-                struct ieee80211_frame *wh = (struct ieee80211_frame *)skb->data;
-                u_int8_t dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                        pkttype = PACKET_HOST;
+                } else {
+                        /* 
+                         * The frame passed it's CRC, so we can rely
+                         * on the contents of the frame to set pkttype.
+                         */
+                        if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
+                                if (IEEE80211_ADDR_EQ(wh->i_addr1, dev->broadcast))
+                                        pkttype = PACKET_BROADCAST;
+                                else
+                                        pkttype = PACKET_MULTICAST;
+                        } else
+                                pkttype = (tx) ? PACKET_OUTGOING : PACKET_HOST;
+                }
-
-                next = TAILQ_NEXT(vap, iv_next);
-                if (vap->iv_opmode != IEEE80211_M_MONITOR ||
-                    vap->iv_state != IEEE80211_S_RUN)
-                        continue;

net80211/ieee80211_var.h

@@ -321 +321 @@
-
-        int iv_monitor_nods_only;               /* in monitor mode only nods traffic */
-        int iv_monitor_txf_len;                 /* in monitor mode, truncate tx packets */
+        int iv_monitor_phy_errors;              /* in monitor mode, accept phy errors */
+        int iv_monitor_crc_errors;              /* in monitor mode, accept crc errors */
-
-        int (*iv_newstate)(struct ieee80211vap *, enum ieee80211_state, int);
-        u_int8_t iv_myaddr[IEEE80211_ADDR_LEN];

net80211/ieee80211_linux.c

@@ -565 +565 @@
-        }
-        return ret;
-}
+static int
+IEEE80211_SYSCTL_DECL(ieee80211_sysctl_monitor_phy_errors, ctl, write, filp, buffer,
+        lenp, ppos)
+{
+        struct ieee80211vap *vap = ctl->extra1;
+        u_int val;
+        int ret;
-
+        ctl->data = &val;
+        ctl->maxlen = sizeof(val);
+        if (write) {
+                ret = IEEE80211_SYSCTL_PROC_DOINTVEC(ctl, write, filp, buffer,
+                        lenp, ppos);
+                if (ret == 0)
+                        vap->iv_monitor_phy_errors = val;
+        } else {
+                val = vap->iv_monitor_phy_errors;
+                ret = IEEE80211_SYSCTL_PROC_DOINTVEC(ctl, write, filp, buffer,
+                        lenp, ppos);
+        }
+        return ret;
+}
+
+static int
+IEEE80211_SYSCTL_DECL(ieee80211_sysctl_monitor_crc_errors, ctl, write, filp, buffer,
+        lenp, ppos)
+{
+        struct ieee80211vap *vap = ctl->extra1;
+        u_int val;
+        int ret;
+
+        ctl->data = &val;
+        ctl->maxlen = sizeof(val);
+        if (write) {
+                ret = IEEE80211_SYSCTL_PROC_DOINTVEC(ctl, write, filp, buffer,
+                        lenp, ppos);
+                if (ret == 0)
+                        vap->iv_monitor_crc_errors = val;
+        } else {
+                val = vap->iv_monitor_crc_errors;
+                ret = IEEE80211_SYSCTL_PROC_DOINTVEC(ctl, write, filp, buffer,
+                        lenp, ppos);
+        }
+        return ret;
+}
+
-#define CTL_AUTO        -2      /* cannot be CTL_ANY or CTL_NONE */
-
-static const ctl_table ieee80211_sysctl_template[] = {
@@ -591 +636 @@
-          .mode         = 0644,
-          .proc_handler = ieee80211_sysctl_monitor_txf_len
-        },
+        { .ctl_name     = CTL_AUTO,
+          .procname     = "monitor_phy_errors",
+          .mode         = 0644,
+          .proc_handler = ieee80211_sysctl_monitor_phy_errors
+        },
+        { .ctl_name     = CTL_AUTO,
+          .procname     = "monitor_crc_errors",
+          .mode         = 0644,
+          .proc_handler = ieee80211_sysctl_monitor_crc_errors
+        },
-        /* NB: must be last entry before NULL */
-        { .ctl_name     = CTL_AUTO,
-          .procname     = "%parent",

ath/if_ath.c

@@ -5561 +5561 @@
-                                sc->sc_stats.ast_rx_phyerr++;
-                                phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
-                                sc->sc_stats.ast_rx_phy[phyerr]++;
-                                goto rx_next;
-                        }
-                        if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT) {
-                                /*
@@ -5602 +5601 @@
-                                }
-                        }
-                        /*
-
-
-
+
+
-                         */
-
-
-
-
+
-                }
-rx_accept:
-                /*
@@ -5634 +5629 @@
-                skb->protocol = ETH_P_CONTROL;          /* XXX */
-
-                if (sc->sc_nmonvaps > 0) {
-
-
-
-
-
+
+
+
-                         */
+#if 0
-                        if (len < IEEE80211_ACK_LEN) {
-                                DPRINTF(sc, ATH_DEBUG_RECV,
-                                        "%s: runt packet %d\n", __func__, len);
@@ -5648 +5642 @@
-                                skb = NULL;
-                                goto rx_next;
-                        }
+#endif
-                        ath_rx_capture(dev, ds, skb);
-                        if (sc->sc_ic.ic_opmode == IEEE80211_M_MONITOR) {
-                                /* no other VAPs need the packet */
@@ -5657 +5652 @@
-                        }
-                }
-
+                /*
+                 * Finished monitor mode handling, now reject
+                 * error frames before passing to other vaps
+                 */
+                if (ds->ds_rxstat.rs_status != 0) {
+                        dev_kfree_skb(skb);
+                        skb = NULL;
+                        goto rx_next;
+                }
+                
-                /* remove the CRC */
-                skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
-