mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-12-09 16:20:11 +00:00
271f1e65ff
When wcn36xx_dxe_tx_frame() fails to transmit the TX frame, the driver will call into ieee80211_free_txskb() for the skb in flight, so it'll no longer be valid. Hence, we shouldn't keep a reference to it in ctl->skb. Also, if the skb has IEEE80211_TX_CTL_REQ_TX_STATUS set, a pointer to it will currently remain in wcn->tx_ack_skb, which will potentially lead to a crash if accessed later. Fix this by checking the return value of wcn36xx_dxe_tx_frame(), and nullify wcn->tx_ack_skb again in case of errors. Move the assignment of ctl->skb in wcn36xx_dxe_tx_frame() so it only happens when the transmission is successful. Signed-off-by: Daniel Mack <daniel@zonque.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
||
|---|---|---|
| .. | ||
| ar5523 | ||
| ath5k | ||
| ath6kl | ||
| ath9k | ||
| ath10k | ||
| carl9170 | ||
| wcn36xx | ||
| wil6210 | ||
| ath.h | ||
| debug.c | ||
| dfs_pattern_detector.c | ||
| dfs_pattern_detector.h | ||
| dfs_pri_detector.c | ||
| dfs_pri_detector.h | ||
| hw.c | ||
| Kconfig | ||
| key.c | ||
| main.c | ||
| Makefile | ||
| reg.h | ||
| regd_common.h | ||
| regd.c | ||
| regd.h | ||
| spectral_common.h | ||
| trace.c | ||
| trace.h | ||