Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07e5a5f5 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: fix crash with P2P Device returning action frames 



If a P2P Device interface receives an unhandled action
frame, we attempt to return it. This crashes because it
doesn't have a channel context. Fix the crash by using
status->band and properly mark the return frame as an
off-channel frame.

Reported-by: default avatarIlan Peer <ilan.peer@intel.com>
Reviewed-by: default avatarIlan Peer <ilan.peer@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 1345ee6a

net/mac80211/rx.c

+13 −1
Original line number Diff line number Diff line
@@ -2675,7 +2675,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 


		memset(nskb->cb, 0, sizeof(nskb->cb));



		ieee80211_tx_skb(rx->sdata, nskb);

		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {

			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);



			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |

				      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |

				      IEEE80211_TX_CTL_NO_CCK_RATE;

			if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)

				info->hw_queue =

					local->hw.offchannel_tx_hw_queue;

		}



		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,

					    status->band);

	}

	dev_kfree_skb(rx->skb);

	return RX_QUEUED;