[PATCH] iwlagn: fix offchannel TX bug

[PATCH] iwlagn: fix offchannel TX bug

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

In the case where remain-on-channel rather than
offchannel TX should be used, my offchannel TX
patch introduced a bug because mac80211 will
use the now-freed SKB.

iwlagn shouldn't free the SKB when it returns 1
here since then the SKB will still be used.

Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 drivers/net/wireless/iwlwifi/iwl-agn.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/iwlwifi/iwl-agn.c	2011-03-05 19:32:58.000000000 +0100
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c	2011-03-05 19:33:08.000000000 +0100
@@ -3171,7 +3171,7 @@ static int iwl_mac_offchannel_tx(struct
  out:
 	mutex_unlock(&priv->mutex);
  free:
-	if (ret)
+	if (ret < 0)
 		kfree_skb(skb);
 
 	return ret;

Re: [PATCH] iwlagn: fix offchannel TX bug

[John W. Linville]

On Sat, Mar 05, 2011 at 07:35:39PM +0100, Johannes Berg wrote:
> From: Johannes Berg <johannes.berg@intel.com>
> 
> In the case where remain-on-channel rather than
> offchannel TX should be used, my offchannel TX
> patch introduced a bug because mac80211 will
> use the now-freed SKB.
> 
> iwlagn shouldn't free the SKB when it returns 1
> here since then the SKB will still be used.
> 
> Reported-by: Reinette Chatre <reinette.chatre@intel.com>
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
> ---
>  drivers/net/wireless/iwlwifi/iwl-agn.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> --- a/drivers/net/wireless/iwlwifi/iwl-agn.c	2011-03-05 19:32:58.000000000 +0100
> +++ b/drivers/net/wireless/iwlwifi/iwl-agn.c	2011-03-05 19:33:08.000000000 +0100
> @@ -3171,7 +3171,7 @@ static int iwl_mac_offchannel_tx(struct
>   out:
>  	mutex_unlock(&priv->mutex);
>   free:
> -	if (ret)
> +	if (ret < 0)
>  		kfree_skb(skb);
>  
>  	return ret;

OK, I give-up...what tree is this against? :-)

-- 
John W. Linville		Someday the world will need a hero, and you
linville@tuxdriver.com			might be all we have.  Be ready.

Re: [PATCH] iwlagn: fix offchannel TX bug

[Johannes Berg]

On Mon, 2011-03-07 at 13:54 -0500, John W. Linville wrote:

> > --- a/drivers/net/wireless/iwlwifi/iwl-agn.c	2011-03-05 19:32:58.000000000 +0100
> > +++ b/drivers/net/wireless/iwlwifi/iwl-agn.c	2011-03-05 19:33:08.000000000 +0100
> > @@ -3171,7 +3171,7 @@ static int iwl_mac_offchannel_tx(struct
> >   out:
> >  	mutex_unlock(&priv->mutex);
> >   free:
> > -	if (ret)
> > +	if (ret < 0)
> >  		kfree_skb(skb);
> >  
> >  	return ret;
> 
> OK, I give-up...what tree is this against? :-)

Oh dang, it's against our own tree and I thought we'd already sent out
the patch "iwlagn: support off-channel TX". Clearly, that isn't the
case. Wey-yi, can you please merge this fix with the patch?

Sorry about that!

johannes

Re: [PATCH] iwlagn: fix offchannel TX bug

[Guy, Wey-Yi]

On Mon, 2011-03-07 at 11:02 -0800, Johannes Berg wrote:
> On Mon, 2011-03-07 at 13:54 -0500, John W. Linville wrote:
> 
> > > --- a/drivers/net/wireless/iwlwifi/iwl-agn.c	2011-03-05 19:32:58.000000000 +0100
> > > +++ b/drivers/net/wireless/iwlwifi/iwl-agn.c	2011-03-05 19:33:08.000000000 +0100
> > > @@ -3171,7 +3171,7 @@ static int iwl_mac_offchannel_tx(struct
> > >   out:
> > >  	mutex_unlock(&priv->mutex);
> > >   free:
> > > -	if (ret)
> > > +	if (ret < 0)
> > >  		kfree_skb(skb);
> > >  
> > >  	return ret;
> > 
> > OK, I give-up...what tree is this against? :-)
> 
> Oh dang, it's against our own tree and I thought we'd already sent out
> the patch "iwlagn: support off-channel TX". Clearly, that isn't the
> case. Wey-yi, can you please merge this fix with the patch?
> 
> Sorry about that!

oh, sorry, I did not merge because waiting for the patch to fix the
iwlagn compiling problem. sorry!

Wey
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html