rt2x00: Validate MCS on RX path
Similar to the PLCP signal and bitrates values,
we should validate the MCS value from the RX descriptor
before sending it to mac80211.
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 9b745fa..db25209 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -432,36 +432,44 @@
struct ieee80211_supported_band *sband;
const struct rt2x00_rate *rate;
unsigned int i;
- int signal;
- int type;
+ int signal = rxdesc->signal;
+ int type = (rxdesc->dev_flags & RXDONE_SIGNAL_MASK);
- /*
- * For non-HT rates the MCS value needs to contain the
- * actually used rate modulation (CCK or OFDM).
- */
- if (rxdesc->dev_flags & RXDONE_SIGNAL_MCS)
- signal = RATE_MCS(rxdesc->rate_mode, rxdesc->signal);
- else
- signal = rxdesc->signal;
+ switch (rxdesc->rate_mode) {
+ case RATE_MODE_CCK:
+ case RATE_MODE_OFDM:
+ /*
+ * For non-HT rates the MCS value needs to contain the
+ * actually used rate modulation (CCK or OFDM).
+ */
+ if (rxdesc->dev_flags & RXDONE_SIGNAL_MCS)
+ signal = RATE_MCS(rxdesc->rate_mode, signal);
- type = (rxdesc->dev_flags & RXDONE_SIGNAL_MASK);
-
- sband = &rt2x00dev->bands[rt2x00dev->curr_band];
- for (i = 0; i < sband->n_bitrates; i++) {
- rate = rt2x00_get_rate(sband->bitrates[i].hw_value);
-
- if (((type == RXDONE_SIGNAL_PLCP) &&
- (rate->plcp == signal)) ||
- ((type == RXDONE_SIGNAL_BITRATE) &&
- (rate->bitrate == signal)) ||
- ((type == RXDONE_SIGNAL_MCS) &&
- (rate->mcs == signal))) {
- return i;
+ sband = &rt2x00dev->bands[rt2x00dev->curr_band];
+ for (i = 0; i < sband->n_bitrates; i++) {
+ rate = rt2x00_get_rate(sband->bitrates[i].hw_value);
+ if (((type == RXDONE_SIGNAL_PLCP) &&
+ (rate->plcp == signal)) ||
+ ((type == RXDONE_SIGNAL_BITRATE) &&
+ (rate->bitrate == signal)) ||
+ ((type == RXDONE_SIGNAL_MCS) &&
+ (rate->mcs == signal))) {
+ return i;
+ }
}
+ break;
+ case RATE_MODE_HT_MIX:
+ case RATE_MODE_HT_GREENFIELD:
+ if (signal >= 0 && signal <= 76)
+ return signal;
+ break;
+ default:
+ break;
}
WARNING(rt2x00dev, "Frame received with unrecognized signal, "
- "signal=0x%.4x, type=%d.\n", signal, type);
+ "mode=0x%.4x, signal=0x%.4x, type=%d.\n",
+ rxdesc->rate_mode, signal, type);
return 0;
}
@@ -523,18 +531,12 @@
skb_trim(entry->skb, rxdesc.size);
/*
- * Check if the frame was received using HT. In that case,
- * the rate is the MCS index and should be passed to mac80211
- * directly. Otherwise we need to translate the signal to
- * the correct bitrate index.
+ * Translate the signal to the correct bitrate index.
*/
- if (rxdesc.rate_mode == RATE_MODE_CCK ||
- rxdesc.rate_mode == RATE_MODE_OFDM) {
- rate_idx = rt2x00lib_rxdone_read_signal(rt2x00dev, &rxdesc);
- } else {
+ rate_idx = rt2x00lib_rxdone_read_signal(rt2x00dev, &rxdesc);
+ if (rxdesc.rate_mode == RATE_MODE_HT_MIX ||
+ rxdesc.rate_mode == RATE_MODE_HT_GREENFIELD)
rxdesc.flags |= RX_FLAG_HT;
- rate_idx = rxdesc.signal;
- }
/*
* Update extra components