| commit | cd84516473a78a6932b1e034e71742e14842e8dc | |
| author | Johannes Berg <johannes.berg@intel.com> | |
| Tue, 18 Oct 2016 20:12:08 +0000 (18 23:12 +0300) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Thu, 12 Jan 2017 10:39:23 +0000 (12 11:39 +0100) | ||
| tree | 85d57548ce1394f9379be2aa138c14ff3b9f0efd | treesnapshot (tar.gz zip) |
| parent | 1d9c33f1b45ccc1dfbf55c97d7e1d02155e05787 | commitdiff |
mac80211: fix tid_agg_rx NULL dereference
commit 1c3d185a9a0b136a58e73b02912d593d0303d1da upstream.
On drivers setting the SUPPORTS_REORDERING_BUFFER hardware flag,
we crash when the peer sends an AddBA request while we already
have a session open on the seame TID; this is because on those
drivers, the tid_agg_rx is left NULL even though the session is
valid, and the agg_session_valid bit is set.
To fix this, store the dialog tokens outside the tid_agg_rx to
be able to compare them to the received AddBA request.
Fixes: f89e07d4cf26 ("mac80211: agg-rx: refuse ADDBA Request with timeout update")
Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1c3d185a9a0b136a58e73b02912d593d0303d1da upstream.
On drivers setting the SUPPORTS_REORDERING_BUFFER hardware flag,
we crash when the peer sends an AddBA request while we already
have a session open on the seame TID; this is because on those
drivers, the tid_agg_rx is left NULL even though the session is
valid, and the agg_session_valid bit is set.
To fix this, store the dialog tokens outside the tid_agg_rx to
be able to compare them to the received AddBA request.
Fixes: f89e07d4cf26 ("mac80211: agg-rx: refuse ADDBA Request with timeout update")
Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| net/mac80211/agg-rx.c | diffblobblamehistory | |
| net/mac80211/debugfs_sta.c | diffblobblamehistory | |
| net/mac80211/sta_info.h | diffblobblamehistory |