On Thu, 2013-12-05 at 17:53 -0800, Javier Lopez wrote:
> mac80211_hwsim was crashing when receiving tx information from user
> space. Crash happens because txi->rate_driver_data[0] is pointing to a
> non valid memory address.
>
> This code path is only used by wmediumd and wmediumd doesn't provide
> multiple channel support, so we can update txi->rate_driver_data[0]
> to point to the mac80211_hwsim_data channel information struct
> (data2->channel).
>
> Signed-off-by: Javier Lopez <jlopex@xxxxxxxxxxx>
> ---
> drivers/net/wireless/mac80211_hwsim.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
> index 9c0cc8d..eddf7bf 100644
> --- a/drivers/net/wireless/mac80211_hwsim.c
> +++ b/drivers/net/wireless/mac80211_hwsim.c
> @@ -2013,6 +2013,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
> }
>
> txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
> + txi->rate_driver_data[0] = data2->channel;
It seems this overwrites status data?
> if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
> (hwsim_flags & HWSIM_TX_STAT_ACK)) {
...
if (skb->len >= 16) {
hdr = (struct ieee80211_hdr *) skb->data;
mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
hdr->addr2);
}
txi->flags |= IEEE80211_TX_STAT_ACK;
}
Since nothing else seems to use the rate_driver_data[0] pointer, it
would be much better to just pass the channel here, no?
johannes
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
