2009-11-18 06:09:46

by Sujith

[permalink] [raw]

Subject: [PATCH] mac80211: Fix panic in aggregation handling

---

Not assigning the vif pointer causes an oops.
This patch fixes it.

Signed-off-by: Sujith <[email protected]>
---
net/mac80211/agg-tx.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 6ddd114..26d42e8 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -489,6 +489,7 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
memcpy(&ra_tid->ra, ra, ETH_ALEN);
ra_tid->tid = tid;
+ ra_tid->vif = vif;

skb->pkt_type = IEEE80211_ADDBA_MSG;
skb_queue_tail(&local->skb_queue, skb);
@@ -625,6 +626,7 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
memcpy(&ra_tid->ra, ra, ETH_ALEN);
ra_tid->tid = tid;
+ ra_tid->vif = vif;

skb->pkt_type = IEEE80211_DELBA_MSG;
skb_queue_tail(&local->skb_queue, skb);
--
1.6.5.2

2009-11-18 10:42:45

by Johannes Berg

[permalink] [raw]

Subject: Re: [PATCH] mac80211: Fix panic in aggregation handling

---

On Wed, 2009-11-18 at 11:42 +0530, Sujith wrote:
> Not assigning the vif pointer causes an oops.
> This patch fixes it.

Ouch, sorry about that, and thanks for the fix. I /thought/ I tested it
but apparently not :(

johannes

> Signed-off-by: Sujith <[email protected]>
> ---
> net/mac80211/agg-tx.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
> index 6ddd114..26d42e8 100644
> --- a/net/mac80211/agg-tx.c
> +++ b/net/mac80211/agg-tx.c
> @@ -489,6 +489,7 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
> ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
> memcpy(&ra_tid->ra, ra, ETH_ALEN);
> ra_tid->tid = tid;
> + ra_tid->vif = vif;
>
> skb->pkt_type = IEEE80211_ADDBA_MSG;
> skb_queue_tail(&local->skb_queue, skb);
> @@ -625,6 +626,7 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
> ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
> memcpy(&ra_tid->ra, ra, ETH_ALEN);
> ra_tid->tid = tid;
> + ra_tid->vif = vif;
>
> skb->pkt_type = IEEE80211_DELBA_MSG;
> skb_queue_tail(&local->skb_queue, skb);

---

Attachments:

signature.asc (801.00 B)
This is a digitally signed message part