Hi,
On Mon, Nov 22, 2021 at 09:43:23PM +0100, Felix Fietkau wrote:
> Since retransmission clears info->control, rate control needs to be called
> again, otherwise the driver might crash due to invalid rates.
>
> Cc: stable@xxxxxxxxxxxxxxx # 5.14+
> Reported-by: Aaro Koskinen <aaro.koskinen@xxxxxx>
> Reported-by: Robert W <rwbugreport@xxxxxxxxxxxxxxxxxxxx>
> Fixes: 03c3911d2d67 ("mac80211: call ieee80211_tx_h_rate_ctrl() when dequeue")
> Signed-off-by: Felix Fietkau <nbd@xxxxxxxx>
Tested-by: Aaro Koskinen <aaro.koskinen@xxxxxx>
A.
> ---
> net/mac80211/tx.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
> index 278945e3e08a..e19f6e246642 100644
> --- a/net/mac80211/tx.c
> +++ b/net/mac80211/tx.c
> @@ -1822,15 +1822,15 @@ static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)
> struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
> ieee80211_tx_result res = TX_CONTINUE;
>
> + if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
> + CALL_TXH(ieee80211_tx_h_rate_ctrl);
> +
> if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
> __skb_queue_tail(&tx->skbs, tx->skb);
> tx->skb = NULL;
> goto txh_done;
> }
>
> - if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
> - CALL_TXH(ieee80211_tx_h_rate_ctrl);
> -
> CALL_TXH(ieee80211_tx_h_michael_mic_add);
> CALL_TXH(ieee80211_tx_h_sequence);
> CALL_TXH(ieee80211_tx_h_fragment);
> --
> 2.30.1
>
