mac80211: agg-rx: refuse ADDBA Request with timeout update

The current implementation of handling ADDBA Request while a session
is already active with the peer is wrong - in case the peer is using
the existing session's dialog token this should be treated as update
to the session, which can update the timeout value.

We don't really have a good way of supporting that, so reject, but
implement the required behaviour in the spec of "Even if the updated
ADDBA Request frame is not accepted, the original Block ACK setup
remains active." (802.11-2012 10.5.4)

Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 3a8f881b22f10c983ab354a4393157e090fd6d3a..a9aff6079c42a39cab954d49a499d8c4caa5fa2f 100644 (file)
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -306,6 +306,24 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
        mutex_lock(&sta->ampdu_mlme.mtx);
 
        if (test_bit(tid, sta->ampdu_mlme.agg_session_valid)) {
+               tid_agg_rx = rcu_dereference_protected(
+                               sta->ampdu_mlme.tid_rx[tid],
+                               lockdep_is_held(&sta->ampdu_mlme.mtx));
+
+               if (tid_agg_rx->dialog_token == dialog_token) {
+                       ht_dbg_ratelimited(sta->sdata,
+                                          "updated AddBA Req from %pM on tid %u\n",
+                                          sta->sta.addr, tid);
+                       /* We have no API to update the timeout value in the
+                        * driver so reject the timeout update.
+                        */
+                       status = WLAN_STATUS_REQUEST_DECLINED;
+                       ieee80211_send_addba_resp(sta->sdata, sta->sta.addr,
+                                                 tid, dialog_token, status,
+                                                 1, buf_size, timeout);
+                       goto end;
+               }
+
                ht_dbg_ratelimited(sta->sdata,
                                   "unexpected AddBA Req from %pM on tid %u\n",
                                   sta->sta.addr, tid);