aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2016-02-14 12:26:49 +0000
committerFelix Fietkau <nbd@openwrt.org>2016-02-14 12:26:49 +0000
commit6cfc7db8a210be5ac63898dc2f78786abf455942 (patch)
tree8f5d4c96cc5484eff7c3030e292e8097bf325ef7
parentc8cbe7aba273e44493d6a3d093a1f1e279489c29 (diff)
downloadupstream-6cfc7db8a210be5ac63898dc2f78786abf455942.tar.gz
upstream-6cfc7db8a210be5ac63898dc2f78786abf455942.tar.bz2
upstream-6cfc7db8a210be5ac63898dc2f78786abf455942.zip
mac80211: fix a crash in monitor mode injection
Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48719
-rw-r--r--package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch36
1 files changed, 36 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch b/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch
new file mode 100644
index 0000000000..f8f4f0999d
--- /dev/null
+++ b/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch
@@ -0,0 +1,36 @@
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+Date: Wed, 10 Feb 2016 16:08:17 +0100
+Subject: [PATCH] mac80211: fix wiphy supported_band access
+
+Fix wiphy supported_band access in tx radiotap parsing. In particular,
+info->band is always set to 0 (IEEE80211_BAND_2GHZ) since it has not
+assigned yet. This cause a kernel crash on 5GHz only devices.
+Move ieee80211_parse_tx_radiotap() after info->band assignment
+
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1890,10 +1890,6 @@ netdev_tx_t ieee80211_monitor_start_xmit
+ info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+ IEEE80211_TX_CTL_INJECTED;
+
+- /* process and remove the injection radiotap header */
+- if (!ieee80211_parse_tx_radiotap(local, skb))
+- goto fail;
+-
+ rcu_read_lock();
+
+ /*
+@@ -1955,6 +1951,10 @@ netdev_tx_t ieee80211_monitor_start_xmit
+ goto fail_rcu;
+
+ info->band = chandef->chan->band;
++ /* process and remove the injection radiotap header */
++ if (!ieee80211_parse_tx_radiotap(local, skb))
++ goto fail_rcu;
++
+ ieee80211_xmit(sdata, NULL, skb);
+ rcu_read_unlock();
+