mac80211: Fix panic on fragmentation with power saving
authorJouni Malinen <j@w1.fi>
Fri, 13 Mar 2009 11:59:39 +0000 (13:59 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 16 Mar 2009 22:01:59 +0000 (18:01 -0400)
It was possible to hit a kernel panic on NULL pointer dereference in
dev_queue_xmit() when sending power save buffered frames to a STA that
woke up from sleep. This happened when the buffered frame was requeued
for transmission in ap_sta_ps_end(). In order to avoid the panic, copy
the skb->dev and skb->iif values from the first fragment to all other
fragments.

Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/mac80211/tx.c

index 94de503..37e3d5e 100644 (file)
@@ -752,6 +752,8 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                skb_copy_queue_mapping(frag, first);
 
                frag->do_not_encrypt = first->do_not_encrypt;
+               frag->dev = first->dev;
+               frag->iif = first->iif;
 
                pos += copylen;
                left -= copylen;