gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

mt7603: fix double-free in tx status path

Browse Source 
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2016-02-19 22:09:20 +01:00
parent 796c59fd18
commit 424ea5d784
2 changed files with 23 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7603.h
+3 -2
View File
@@ -72,8 +72,9 @@ struct mt7603_vif {
struct mt7603_sta sta;
};
#define MT7603_CB_DMA_DONE BIT(0)
#define MT7603_CB_TXS_DONE BIT(1)
#define MT7603_CB_DMA_DONE BIT(0)
#define MT7603_CB_TXS_DONE BIT(1)
#define MT7603_CB_TXS_FAILED BIT(2)
struct mt7603_cb {
struct list_head list;
mt7603_mac.c
+20 -15
View File
@@ -615,6 +615,24 @@ mt7603_fill_txs(struct mt7603_dev *dev, struct mt7603_sta *sta,
sta->ampdu_acked = 0;
}
static void
mt7603_skb_done(struct mt7603_dev *dev, struct sk_buff *skb, u8 flags)
{
struct mt7603_cb *cb = mt7603_skb_cb(skb);
u8 done = MT7603_CB_DMA_DONE | MT7603_CB_TXS_DONE;
flags |= cb->flags;
cb->flags = flags;
if ((flags & done) != done)
return;
if (flags & MT7603_CB_TXS_FAILED)
ieee80211_free_txskb(mt76_hw(dev), skb);
else
ieee80211_tx_status(mt76_hw(dev), skb);
}
struct sk_buff *
mt7603_mac_status_skb(struct mt7603_dev *dev, struct mt7603_sta *sta, int pktid)
{
@@ -631,27 +649,14 @@ mt7603_mac_status_skb(struct mt7603_dev *dev, struct mt7603_sta *sta, int pktid)
if (cb->pktid == pktid)
break;
ieee80211_free_txskb(mt76_hw(dev), skb);
mt7603_skb_done(dev, skb,
MT7603_CB_TXS_FAILED | MT7603_CB_TXS_DONE);
skb = NULL;
}
return skb;
}
static void
mt7603_skb_done(struct mt7603_dev *dev, struct sk_buff *skb, u8 flags)
{
struct mt7603_cb *cb = mt7603_skb_cb(skb);
flags |= cb->flags;
cb->flags = flags;
if (flags != (MT7603_CB_DMA_DONE | MT7603_CB_TXS_DONE))
return;
ieee80211_tx_status(mt76_hw(dev), skb);
}
static bool
mt7603_mac_add_txs_skb(struct mt7603_dev *dev, struct mt7603_sta *sta, int pid,
__le32 *txs_data)