Sfoglia il codice sorgente

ath10k: fix NULL dereference for injected packets

Tx processing functions dereference vif and caused
NULL to be dereferenced for injected frames.

Don't call these functions at all for injected
frames. It doesn't make much sense to do so
anyway.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Michal Kazior 12 anni fa
parent
commit
cf84bd4def
1 ha cambiato i file con 8 aggiunte e 4 eliminazioni
  1. 8 4
      drivers/net/wireless/ath/ath10k/mac.c

+ 8 - 4
drivers/net/wireless/ath/ath10k/mac.c

@@ -1710,10 +1710,14 @@ static void ath10k_tx(struct ieee80211_hw *hw,
 		tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
 		tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
 	}
 	}
 
 
-	ath10k_tx_h_qos_workaround(hw, control, skb);
-	ath10k_tx_h_update_wep_key(skb);
-	ath10k_tx_h_add_p2p_noa_ie(ar, skb);
-	ath10k_tx_h_seq_no(skb);
+	/* it makes no sense to process injected frames like that */
+	if (info->control.vif &&
+	    info->control.vif->type != NL80211_IFTYPE_MONITOR) {
+		ath10k_tx_h_qos_workaround(hw, control, skb);
+		ath10k_tx_h_update_wep_key(skb);
+		ath10k_tx_h_add_p2p_noa_ie(ar, skb);
+		ath10k_tx_h_seq_no(skb);
+	}
 
 
 	memset(ATH10K_SKB_CB(skb), 0, sizeof(*ATH10K_SKB_CB(skb)));
 	memset(ATH10K_SKB_CB(skb), 0, sizeof(*ATH10K_SKB_CB(skb)));
 	ATH10K_SKB_CB(skb)->htt.vdev_id = vdev_id;
 	ATH10K_SKB_CB(skb)->htt.vdev_id = vdev_id;