From 3bb2e382f6836e36724e0654a04b106bafc9cd71 Mon Sep 17 00:00:00 2001 From: nbd Date: Thu, 14 Jun 2012 21:36:05 +0000 Subject: ath9k: fix an invalid pointer access in the tx path git-svn-id: svn://svn.openwrt.org/openwrt/trunk@32376 3c298f89-4303-0410-b956-a3cf2f4a3e73 --- package/mac80211/patches/300-pending_work.patch | 50 ++++++++++++++++++++++ .../patches/512-ath9k_channelbw_debugfs.patch | 4 +- .../mac80211/patches/530-ath9k_limit_qlen.patch | 12 +++--- .../mac80211/patches/540-ath9k_extra_leds.patch | 6 +-- 4 files changed, 61 insertions(+), 11 deletions(-) diff --git a/package/mac80211/patches/300-pending_work.patch b/package/mac80211/patches/300-pending_work.patch index 73190796f..9044396dc 100644 --- a/package/mac80211/patches/300-pending_work.patch +++ b/package/mac80211/patches/300-pending_work.patch @@ -523,3 +523,53 @@ } #endif +--- a/drivers/net/wireless/ath/ath9k/ath9k.h ++++ b/drivers/net/wireless/ath/ath9k/ath9k.h +@@ -214,6 +214,7 @@ struct ath_frame_info { + enum ath9k_key_type keytype; + u8 keyix; + u8 retries; ++ bool short_preamble; + }; + + struct ath_buf_state { +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -938,6 +938,7 @@ static void ath_buf_set_rate(struct ath_ + struct ieee80211_tx_rate *rates; + const struct ieee80211_rate *rate; + struct ieee80211_hdr *hdr; ++ struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu); + int i; + u8 rix = 0; + +@@ -957,8 +958,7 @@ static void ath_buf_set_rate(struct ath_ + rate = ieee80211_get_rts_cts_rate(sc->hw, tx_info); + info->rtscts_rate = rate->hw_value; + +- if (tx_info->control.vif && +- tx_info->control.vif->bss_conf.use_short_preamble) ++ if (fi->short_preamble) + info->rtscts_rate |= rate->hw_value_short; + + for (i = 0; i < 4; i++) { +@@ -1779,6 +1779,11 @@ static void setup_frame_info(struct ieee + struct ath_frame_info *fi = get_frame_info(skb); + struct ath_node *an = NULL; + enum ath9k_key_type keytype; ++ bool short_preamble = false; ++ ++ if (tx_info->control.vif && ++ tx_info->control.vif->bss_conf.use_short_preamble) ++ short_preamble = true; + + keytype = ath9k_cmn_get_hw_crypto_keytype(skb); + +@@ -1794,6 +1799,7 @@ static void setup_frame_info(struct ieee + fi->keyix = ATH9K_TXKEYIX_INVALID; + fi->keytype = keytype; + fi->framelen = framelen; ++ fi->short_preamble = short_preamble; + } + + u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate) diff --git a/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch b/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch index 637fadaa1..6410a6e2b 100644 --- a/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch +++ b/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch @@ -1,6 +1,6 @@ --- a/drivers/net/wireless/ath/ath9k/ath9k.h +++ b/drivers/net/wireless/ath/ath9k/ath9k.h -@@ -620,6 +620,7 @@ struct ath_softc { +@@ -621,6 +621,7 @@ struct ath_softc { struct ieee80211_hw *hw; struct device *dev; @@ -8,7 +8,7 @@ struct survey_info *cur_survey; struct survey_info survey[ATH9K_NUM_CHANNELS]; -@@ -687,6 +688,7 @@ struct ath_softc { +@@ -688,6 +689,7 @@ struct ath_softc { struct dfs_pattern_detector *dfs_detector; }; diff --git a/package/mac80211/patches/530-ath9k_limit_qlen.patch b/package/mac80211/patches/530-ath9k_limit_qlen.patch index 22b4102d1..f4eb51e97 100644 --- a/package/mac80211/patches/530-ath9k_limit_qlen.patch +++ b/package/mac80211/patches/530-ath9k_limit_qlen.patch @@ -1,6 +1,6 @@ --- a/drivers/net/wireless/ath/ath9k/ath9k.h +++ b/drivers/net/wireless/ath/ath9k/ath9k.h -@@ -243,6 +243,7 @@ struct ath_atx_tid { +@@ -244,6 +244,7 @@ struct ath_atx_tid { struct ath_node *an; struct ath_atx_ac *ac; unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)]; @@ -8,7 +8,7 @@ int bar_index; u16 seq_start; u16 seq_next; -@@ -289,6 +290,9 @@ struct ath_tx_control { +@@ -290,6 +291,9 @@ struct ath_tx_control { * (axq_qnum). */ struct ath_tx { @@ -74,7 +74,7 @@ /* Queue to h/w without aggregation */ TX_STAT_INC(txctl->txq->axq_qnum, a_queued_hw); bf->bf_lastbf = bf; -@@ -1873,22 +1886,11 @@ error: +@@ -1879,22 +1892,11 @@ error: /* FIXME: tx power */ static void ath_tx_start_dma(struct ath_softc *sc, struct sk_buff *skb, @@ -99,7 +99,7 @@ if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && tid) { /* -@@ -1920,6 +1922,7 @@ int ath_tx_start(struct ieee80211_hw *hw +@@ -1926,6 +1928,7 @@ int ath_tx_start(struct ieee80211_hw *hw struct ieee80211_vif *vif = info->control.vif; struct ath_softc *sc = hw->priv; struct ath_txq *txq = txctl->txq; @@ -107,7 +107,7 @@ int padpos, padsize; int frmlen = skb->len + FCS_LEN; int q; -@@ -1962,6 +1965,24 @@ int ath_tx_start(struct ieee80211_hw *hw +@@ -1968,6 +1971,24 @@ int ath_tx_start(struct ieee80211_hw *hw setup_frame_info(hw, skb, frmlen); @@ -132,7 +132,7 @@ /* * At this point, the vif, hw_key and sta pointers in the tx control * info are no longer valid (overwritten by the ath_frame_info data. -@@ -1976,7 +1997,7 @@ int ath_tx_start(struct ieee80211_hw *hw +@@ -1982,7 +2003,7 @@ int ath_tx_start(struct ieee80211_hw *hw txq->stopped = true; } diff --git a/package/mac80211/patches/540-ath9k_extra_leds.patch b/package/mac80211/patches/540-ath9k_extra_leds.patch index a34a4e1f8..250e9cf31 100644 --- a/package/mac80211/patches/540-ath9k_extra_leds.patch +++ b/package/mac80211/patches/540-ath9k_extra_leds.patch @@ -1,6 +1,6 @@ --- a/drivers/net/wireless/ath/ath9k/ath9k.h +++ b/drivers/net/wireless/ath/ath9k/ath9k.h -@@ -507,6 +507,9 @@ static inline u16 ath9k_btcoex_aggr_limi +@@ -508,6 +508,9 @@ static inline u16 ath9k_btcoex_aggr_limi #ifdef CONFIG_MAC80211_LEDS void ath_init_leds(struct ath_softc *sc); void ath_deinit_leds(struct ath_softc *sc); @@ -10,7 +10,7 @@ #else static inline void ath_init_leds(struct ath_softc *sc) { -@@ -620,6 +623,13 @@ struct ath9k_vif_iter_data { +@@ -621,6 +624,13 @@ struct ath9k_vif_iter_data { int nadhocs; /* number of adhoc vifs */ }; @@ -24,7 +24,7 @@ struct ath_softc { struct ieee80211_hw *hw; struct device *dev; -@@ -661,9 +671,8 @@ struct ath_softc { +@@ -662,9 +672,8 @@ struct ath_softc { struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS]; #ifdef CONFIG_MAC80211_LEDS -- cgit v1.2.3