From: Greg KH on
2.6.33-stable review patch. If anyone has any objections, please let me know.


From: Shanyu Zhao <shanyu.zhao(a)>

commit a2c40249a36d0b4d76d1caf6bf806e4ae5b06e8a upstream.

Currently whenever rts thresold is set, every packet will use RTS
protection no matter its size exceeds the threshold or not. This is
due to a bug in the rts threshold check.
if (len > tx->local->hw.wiphy->rts_threshold) {
txrc.rts = rts = true;
Basically it is comparing an int (len) and a u32 (rts_threshold),
and the variable len is assigned as:
len = min_t(int, tx->skb->len + FCS_LEN,
However, when frag_threshold is "-1", len is always "-1", which is
0xffffffff therefore rts is always set to true.

Signed-off-by: Shanyu Zhao <shanyu.zhao(a)>
Reviewed-by: Johannes Berg <johannes(a)>
Signed-off-by: John W. Linville <linville(a)>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)>

net/mac80211/tx.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -501,7 +501,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
struct ieee80211_hdr *hdr = (void *)tx->skb->data;
struct ieee80211_supported_band *sband;
struct ieee80211_rate *rate;
- int i, len;
+ int i;
+ u32 len;
bool inval = false, rts = false, short_preamble = false;
struct ieee80211_tx_rate_control txrc;
u32 sta_flags;
@@ -510,7 +511,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021

sband = tx->local->hw.wiphy->bands[tx->channel->band];

- len = min_t(int, tx->skb->len + FCS_LEN,
+ len = min_t(u32, tx->skb->len + FCS_LEN,

/* set up the tx rate control struct we give the RC algo */

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)
More majordomo info at
Please read the FAQ at