Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f168014 authored by Eliad Peller's avatar Eliad Peller Committed by Luciano Coelho
Browse files

wl12xx: handle injected packets 



Injected packets are sent with no vif, causing the wl12xx
to NULL-dereference in multiple places.

Furthermore, injected packets are currently not sent at all,
as system_hlid doesn't belong to any specific role, so
wl1271_skb_dequeue() never return its packets.

Handle both these problems.

Reported-by: default avatarLuciano Coelho <coelho@ti.com>
Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
Signed-off-by: default avatarLuciano Coelho <coelho@ti.com>
parent ccb62000

drivers/net/wireless/wl12xx/main.c

+5 −2
Original line number Diff line number Diff line
@@ -1477,11 +1477,14 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb) 
	struct wl1271 *wl = hw->priv;

	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

	struct ieee80211_vif *vif = info->control.vif;

	struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);

	struct wl12xx_vif *wlvif = NULL;

	unsigned long flags;

	int q, mapping;

	u8 hlid;



	if (vif)

		wlvif = wl12xx_vif_to_data(vif);



	mapping = skb_get_queue_mapping(skb);

	q = wl1271_tx_get_queue(mapping);
@@ -1491,7 +1494,7 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb) 


	/* queue the packet */

	if (hlid == WL12XX_INVALID_LINK_ID ||

	    !test_bit(hlid, wlvif->links_map)) {

	    (wlvif && !test_bit(hlid, wlvif->links_map))) {

		wl1271_debug(DEBUG_TX, "DROP skb hlid %d q %d", hlid, q);

		dev_kfree_skb(skb);

		goto out;

drivers/net/wireless/wl12xx/tx.c

+13 −14
Original line number Diff line number Diff line
@@ -185,7 +185,7 @@ u8 wl12xx_tx_get_hlid(struct wl1271 *wl, struct wl12xx_vif *wlvif, 
{

	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;



	if (wl12xx_is_dummy_packet(wl, skb))

	if (!wlvif || wl12xx_is_dummy_packet(wl, skb))

		return wl->system_hlid;



	if (wlvif->bss_type == BSS_TYPE_AP_BSS)
@@ -264,7 +264,8 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif, 
		ac = wl1271_tx_get_queue(skb_get_queue_mapping(skb));

		wl->tx_allocated_pkts[ac]++;



		if (!is_dummy && wlvif->bss_type == BSS_TYPE_AP_BSS &&

		if (!is_dummy && wlvif &&

		    wlvif->bss_type == BSS_TYPE_AP_BSS &&

		    test_bit(hlid, wlvif->ap.sta_hlid_map))

			wl->links[hlid].allocated_pkts++;
@@ -307,7 +308,7 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif, 
	desc->start_time = cpu_to_le32(hosttime - wl->time_offset);



	is_dummy = wl12xx_is_dummy_packet(wl, skb);

	if (is_dummy || wlvif->bss_type != BSS_TYPE_AP_BSS)

	if (is_dummy || !wlvif || wlvif->bss_type != BSS_TYPE_AP_BSS)

		desc->life_time = cpu_to_le16(TX_HW_MGMT_PKT_LIFETIME_TU);

	else

		desc->life_time = cpu_to_le16(TX_HW_AP_MODE_PKT_LIFETIME_TU);
@@ -326,14 +327,14 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif, 
			   TX_HW_ATTR_SESSION_COUNTER;



		tx_attr |= TX_HW_ATTR_TX_DUMMY_REQ;

	} else {

	} else if (wlvif) {

		/* configure the tx attributes */

		tx_attr = wlvif->session_counter <<

			  TX_HW_ATTR_OFST_SESSION_COUNTER;

	}



	desc->hlid = hlid;

	if (is_dummy)

	if (is_dummy || !wlvif)

		rate_idx = 0;

	else if (wlvif->bss_type != BSS_TYPE_AP_BSS) {

		/* if the packets are destined for AP (have a STA entry)
@@ -446,7 +447,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif, 


	wl1271_tx_fill_hdr(wl, wlvif, skb, extra, info, hlid);



	if (!is_dummy && wlvif->bss_type == BSS_TYPE_AP_BSS) {

	if (!is_dummy && wlvif && wlvif->bss_type == BSS_TYPE_AP_BSS) {

		wl1271_tx_ap_update_inconnection_sta(wl, skb);

		wl1271_tx_regulate_link(wl, wlvif, hlid);

	}
@@ -623,6 +624,9 @@ static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl) 
		}

	}



	if (!skb)

		skb = wl12xx_lnk_skb_dequeue(wl, &wl->links[wl->system_hlid]);



	if (!skb &&

	    test_and_clear_bit(WL1271_FLAG_DUMMY_PACKET_PENDING, &wl->flags)) {

		int q;
@@ -716,19 +720,14 @@ void wl1271_tx_work_locked(struct wl1271 *wl) 
		return;



	while ((skb = wl1271_skb_dequeue(wl))) {

		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

		bool has_data = false;



		wlvif = NULL;

		if (!wl12xx_is_dummy_packet(wl, skb)) {

			struct ieee80211_tx_info *info;

			struct ieee80211_vif *vif;

		if (!wl12xx_is_dummy_packet(wl, skb) && info->control.vif)

			wlvif = wl12xx_vif_to_data(info->control.vif);



			info = IEEE80211_SKB_CB(skb);

			vif = info->control.vif;

			wlvif = wl12xx_vif_to_data(vif);

		}

		has_data = wlvif && wl1271_tx_is_data_present(skb);



		ret = wl1271_prepare_tx_frame(wl, wlvif, skb, buf_offset);

		if (ret == -EAGAIN) {

			/*