[PATCH] mac80211: Fix panic in aggregation handling

[PATCH] mac80211: Fix panic in aggregation handling

[Sujith]

Not assigning the vif pointer causes an oops.
This patch fixes it.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
---
 net/mac80211/agg-tx.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 6ddd114..26d42e8 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -489,6 +489,7 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
 	memcpy(&ra_tid->ra, ra, ETH_ALEN);
 	ra_tid->tid = tid;
+	ra_tid->vif = vif;
 
 	skb->pkt_type = IEEE80211_ADDBA_MSG;
 	skb_queue_tail(&local->skb_queue, skb);
@@ -625,6 +626,7 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
 	memcpy(&ra_tid->ra, ra, ETH_ALEN);
 	ra_tid->tid = tid;
+	ra_tid->vif = vif;
 
 	skb->pkt_type = IEEE80211_DELBA_MSG;
 	skb_queue_tail(&local->skb_queue, skb);
-- 
1.6.5.2

Re: [PATCH] mac80211: Fix panic in aggregation handling

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 1189 bytes --]

On Wed, 2009-11-18 at 11:42 +0530, Sujith wrote:
> Not assigning the vif pointer causes an oops.
> This patch fixes it.

Ouch, sorry about that, and thanks for the fix. I /thought/ I tested it
but apparently not :(

johannes

> Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
> ---
>  net/mac80211/agg-tx.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
> index 6ddd114..26d42e8 100644
> --- a/net/mac80211/agg-tx.c
> +++ b/net/mac80211/agg-tx.c
> @@ -489,6 +489,7 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
>  	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
>  	memcpy(&ra_tid->ra, ra, ETH_ALEN);
>  	ra_tid->tid = tid;
> +	ra_tid->vif = vif;
>  
>  	skb->pkt_type = IEEE80211_ADDBA_MSG;
>  	skb_queue_tail(&local->skb_queue, skb);
> @@ -625,6 +626,7 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
>  	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
>  	memcpy(&ra_tid->ra, ra, ETH_ALEN);
>  	ra_tid->tid = tid;
> +	ra_tid->vif = vif;
>  
>  	skb->pkt_type = IEEE80211_DELBA_MSG;
>  	skb_queue_tail(&local->skb_queue, skb);


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]