gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

mt76: mt76x02: fix use-after-free in tx status code handling airtime

Browse Source 
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2019-10-10 21:39:15 +02:00
parent c11a4ad06d
commit 01642d8bed
1 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt76x02_mac.c
+7 -11
View File
@@ -550,7 +550,7 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
u32 duration = 0;
u8 cur_pktid;
u32 ac = 0;
int len;
int len = 0;
if (stat->pktid == MT_PACKET_ID_NO_ACK)
return;
@@ -614,23 +614,19 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
if (status.skb) {
info = *status.info;
len = status.skb->len;
ac = skb_get_queue_mapping(status.skb);
mt76_tx_status_skb_done(mdev, status.skb, &list);
} else if (msta) {
len = status.info->status.ampdu_len * ewma_pktlen_read(&msta->pktlen);
ac = FIELD_GET(MT_PKTID_AC, cur_pktid);
}
mt76_tx_status_unlock(mdev, &list);
if (!status.skb)
ieee80211_tx_status_ext(mt76_hw(dev), &status);
if (status.skb) {
len = status.skb->len;
ac = skb_get_queue_mapping(status.skb);
} else if (msta) {
len = status.info->status.ampdu_len * ewma_pktlen_read(&msta->pktlen);
ac = FIELD_GET(MT_PKTID_AC, cur_pktid);
} else {
goto out;
}
if (!len)
goto out;