mwl8k: fix possible race condition in info->control.sta use

info->control.sta may only be dereferenced during the drv_tx call otherwise
could lead to use-after-free bugs

Reported-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index cf7bdc6..224e03a 100644 (file)
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -1665,7 +1665,9 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
 
                info = IEEE80211_SKB_CB(skb);
                if (ieee80211_is_data(wh->frame_control)) {
-                       sta = info->control.sta;
+                       rcu_read_lock();
+                       sta = ieee80211_find_sta_by_ifaddr(hw, wh->addr1,
+                                                          wh->addr2);
                        if (sta) {
                                sta_info = MWL8K_STA(sta);
                                BUG_ON(sta_info == NULL);
@@ -1682,6 +1684,7 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
                                        sta_info->is_ampdu_allowed = true;
                                }
                        }
+                       rcu_read_unlock();
                }
 
                ieee80211_tx_info_clear_status(info);