Re: [PATCHv2 1/1] mac80211: fix WPA with VLAN on AP side with ps-sta

[Johannes Berg <johannes@sipsolutions.net>]

On Tue, 2013-02-12 at 17:37 +0100, Michael Braun wrote:
> When sending a broadcast while at least on of the connected stations is
> sleeping, it gets queued and send after a DTIM beacon is sent.
> If the packet was to be sent on a vlan interface, the vif used for dequeing
> from the per-bss queue does not hold the per-vlan sdata. The correct sdata is
> required to use the correct per-vlan broadcast/multicast key.
> 
> This patch fixes this by restoring the per-vlan sdata using the skb->dev entry.
> 
> Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
> 
> V2: fix compile warning

That "V2" should be after the ---, but in any case:

> --- a/net/mac80211/tx.c
> +++ b/net/mac80211/tx.c
> @@ -2728,6 +2728,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
>  	struct ps_data *ps;
>  	struct ieee80211_tx_info *info;
>  	struct ieee80211_chanctx_conf *chanctx_conf;
> +	struct ieee80211_sub_if_data *frame_sdata;

There's already an sdata variable, why not write *sdata, *frame_sdata?
 
> @@ -2770,7 +2771,8 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
>  				cpu_to_le16(IEEE80211_FCTL_MOREDATA);
>  		}
>  
> -		if (!ieee80211_tx_prepare(sdata, &tx, skb))
> +		frame_sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
> +		if (!ieee80211_tx_prepare(frame_sdata, &tx, skb))
>  			break;

This can now crash the machine.

johannes