From: Felix Fietkau <nbd@xxxxxxxx> commit f355f70145744518ca1d9799b42f4a8da9aa0d36 upstream. If a packet has reached its intended destination, it was bumped to the code that accepts it, without first checking if a mesh_path needs to be created based on the discovered source. Fix this by moving the destination address check further down. Cc: stable@xxxxxxxxxxxxxxx Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") Signed-off-by: Felix Fietkau <nbd@xxxxxxxx> Link: https://lore.kernel.org/r/20230314095956.62085-3-nbd@xxxxxxxx Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mac80211/rx.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -2770,17 +2770,6 @@ ieee80211_rx_mesh_data(struct ieee80211_ mesh_rmc_check(sdata, eth->h_source, mesh_hdr)) return RX_DROP_MONITOR; - /* Frame has reached destination. Don't forward */ - if (ether_addr_equal(sdata->vif.addr, eth->h_dest)) - goto rx_accept; - - if (!ifmsh->mshcfg.dot11MeshForwarding) { - if (is_multicast_ether_addr(eth->h_dest)) - goto rx_accept; - - return RX_DROP_MONITOR; - } - /* forward packet */ if (sdata->crypto_tx_tailroom_needed_cnt) tailroom = IEEE80211_ENCRYPT_TAILROOM; @@ -2819,6 +2808,17 @@ ieee80211_rx_mesh_data(struct ieee80211_ rcu_read_unlock(); } + /* Frame has reached destination. Don't forward */ + if (ether_addr_equal(sdata->vif.addr, eth->h_dest)) + goto rx_accept; + + if (!ifmsh->mshcfg.dot11MeshForwarding) { + if (is_multicast_ether_addr(eth->h_dest)) + goto rx_accept; + + return RX_DROP_MONITOR; + } + skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]); ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control, Patches currently in stable-queue which might be from nbd@xxxxxxxx are queue-6.1/wifi-cfg80211-fix-receiving-mesh-packets-without-rfc1042-header.patch queue-6.1/wifi-mac80211-fix-potential-null-pointer-dereference.patch queue-6.1/udp-fix-receiving-fraglist-gso-packets.patch queue-6.1/wifi-mac80211-fix-mesh-path-discovery-based-on-unicast-packets.patch queue-6.1/wifi-mac80211-fix-mesh-forwarding.patch queue-6.1/wifi-mac80211-fix-receiving-a-msdu-frames-on-mesh-in.patch queue-6.1/wifi-mac80211-fix-flow-dissection-for-forwarded-packets.patch queue-6.1/wifi-mac80211-drop-bogus-static-keywords-in-a-msdu-rx.patch queue-6.1/wifi-cfg80211-factor-out-bridge-tunnel-rfc1042-heade.patch queue-6.1/wifi-mac80211-fix-receiving-mesh-packets-in-forwarding-0-networks.patch queue-6.1/wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch queue-6.1/wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch queue-6.1/wifi-cfg80211-move-a-msdu-check-in-ieee80211_data_to.patch queue-6.1/wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch