2016-02-19 11:18:04

by Lorenzo Bianconi

Subject: [PATCH v2] mac80211: fix wiphy supported_band access

Fix wiphy supported_band access in tx radiotap parsing introduced
in commit 5ec3aed9ba4c ("mac80211: Parse legacy and HT rate in
injected frames"). In particular, info->band is always set to 0
(IEEE80211_BAND_2GHZ) since it has not assigned yet.
This cause a kernel crash on 5GHz only devices.
Move ieee80211_parse_tx_radiotap() after info->band assignment

Signed-off-by: Lorenzo Bianconi <[email protected]>
---
v2:
- improved the commit message
---
net/mac80211/tx.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 7bb67fa..b07d037 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1892,10 +1892,6 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
IEEE80211_TX_CTL_INJECTED;

- /* process and remove the injection radiotap header */
- if (!ieee80211_parse_tx_radiotap(local, skb))
- goto fail;
-
rcu_read_lock();

/*
@@ -1957,6 +1953,10 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
goto fail_rcu;

info->band = chandef->chan->band;
+ /* process and remove the injection radiotap header */
+ if (!ieee80211_parse_tx_radiotap(local, skb))
+ goto fail_rcu;
+
ieee80211_xmit(sdata, NULL, skb);
rcu_read_unlock();

--
2.5.0

2016-02-23 10:05:28

by Johannes Berg

Subject: Re: [PATCH v2] mac80211: fix wiphy supported_band access

On Fri, 2016-02-19 at 12:18 +0100, Lorenzo Bianconi wrote:
> Fix wiphy supported_band access in tx radiotap parsing introduced
> in commit 5ec3aed9ba4c ("mac80211: Parse legacy and HT rate in
> injected frames"). In particular, info->band is always set to 0
> (IEEE80211_BAND_2GHZ) since it has not assigned yet.
> This cause a kernel crash on 5GHz only devices.
> Move ieee80211_parse_tx_radiotap() after info->band assignment
>
Applied.

johannes