mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
![]() When wcn36xx_dxe_tx_frame() fails to transmit the TX frame, the driver will call into ieee80211_free_txskb() for the skb in flight, so it'll no longer be valid. Hence, we shouldn't keep a reference to it in ctl->skb. Also, if the skb has IEEE80211_TX_CTL_REQ_TX_STATUS set, a pointer to it will currently remain in wcn->tx_ack_skb, which will potentially lead to a crash if accessed later. Fix this by checking the return value of wcn36xx_dxe_tx_frame(), and nullify wcn->tx_ack_skb again in case of errors. Move the assignment of ctl->skb in wcn36xx_dxe_tx_frame() so it only happens when the transmission is successful. Signed-off-by: Daniel Mack <daniel@zonque.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
||
---|---|---|
.. | ||
ar5523 | ||
ath5k | ||
ath6kl | ||
ath9k | ||
ath10k | ||
carl9170 | ||
wcn36xx | ||
wil6210 | ||
ath.h | ||
debug.c | ||
dfs_pattern_detector.c | ||
dfs_pattern_detector.h | ||
dfs_pri_detector.c | ||
dfs_pri_detector.h | ||
hw.c | ||
Kconfig | ||
key.c | ||
main.c | ||
Makefile | ||
reg.h | ||
regd.c | ||
regd.h | ||
regd_common.h | ||
spectral_common.h | ||
trace.c | ||
trace.h |