This is a note to let you know that I've just added the patch titled
wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
wifi-mac80211-reload-info-pointer-in-ieee80211_tx_dequeue.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From c98d8836b817d11fdff4ca7749cbbe04ff7f0c64 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@xxxxxxxxx>
Date: Wed, 31 Jan 2024 16:49:10 +0100
Subject: wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
From: Johannes Berg <johannes.berg@xxxxxxxxx>
commit c98d8836b817d11fdff4ca7749cbbe04ff7f0c64 upstream.
This pointer can change here since the SKB can change, so we
actually later open-coded IEEE80211_SKB_CB() again. Reload
the pointer where needed, so the monitor-mode case using it
gets fixed, and then use info-> later as well.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: 531682159092 ("mac80211: fix VLAN handling with TXQs")
Link: https://msgid.link/20240131164910.b54c28d583bc.I29450cec84ea6773cff5d9c16ff92b836c331471@changeid
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/mac80211/tx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3746,6 +3746,7 @@ begin:
goto begin;
skb = __skb_dequeue(&tx.skbs);
+ info = IEEE80211_SKB_CB(skb);
if (!skb_queue_empty(&tx.skbs)) {
spin_lock_bh(&fq->lock);
@@ -3790,7 +3791,7 @@ begin:
}
encap_out:
- IEEE80211_SKB_CB(skb)->control.vif = vif;
+ info->control.vif = vif;
if (vif &&
wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
Patches currently in stable-queue which might be from johannes.berg@xxxxxxxxx are
queue-5.15/wifi-cfg80211-fix-rcu-dereference-in-__cfg80211_bss_.patch
queue-5.15/wifi-cfg80211-free-beacon_ies-when-overridden-from-h.patch
queue-5.15/wifi-iwlwifi-fix-a-memory-corruption.patch
queue-5.15/wifi-iwlwifi-fix-some-error-codes.patch
queue-5.15/um-time-travel-fix-time-corruption.patch
queue-5.15/wifi-mac80211-reload-info-pointer-in-ieee80211_tx_dequeue.patch
