gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

mt76: fix use-after-free bug in airtime fairness code

Browse Source 
status.info could point to skb->cb, leading to a use-after-free after the tx
status has been reported to mac80211

Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2019-09-29 22:07:16 +02:00
parent 8f22de0611
commit 6f7d0f503d
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt76x02_mac.c
+4 -2
View File
@@ -612,8 +612,10 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
*update = 1;
}
if (status.skb)
if (status.skb) {
info = *status.info;
mt76_tx_status_skb_done(mdev, status.skb, &list);
}
mt76_tx_status_unlock(mdev, &list);
if (!status.skb)
@@ -632,7 +634,7 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
if (!len)
goto out;
duration = mt76_calc_tx_airtime(&dev->mt76, status.info, len);
duration = mt76_calc_tx_airtime(&dev->mt76, &info, len);
spin_lock_bh(&dev->mt76.cc_lock);
dev->tx_airtime += duration;