mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-05 18:39:59 +00:00
mac80211: fix crash with P2P Device returning action frames
If a P2P Device interface receives an unhandled action frame, we attempt to return it. This crashes because it doesn't have a channel context. Fix the crash by using status->band and properly mark the return frame as an off-channel frame. Reported-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
parent
1345ee6a6d
commit
07e5a5f5ab
1 changed files with 13 additions and 1 deletions
|
@ -2675,7 +2675,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
|
|||
|
||||
memset(nskb->cb, 0, sizeof(nskb->cb));
|
||||
|
||||
ieee80211_tx_skb(rx->sdata, nskb);
|
||||
if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
|
||||
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
|
||||
|
||||
info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
|
||||
IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
|
||||
IEEE80211_TX_CTL_NO_CCK_RATE;
|
||||
if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
|
||||
info->hw_queue =
|
||||
local->hw.offchannel_tx_hw_queue;
|
||||
}
|
||||
|
||||
__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
|
||||
status->band);
|
||||
}
|
||||
dev_kfree_skb(rx->skb);
|
||||
return RX_QUEUED;
|
||||
|
|
Loading…
Reference in a new issue