diff options
author | Johannes Berg <johannes.berg@intel.com> | 2015-11-27 21:59:41 +0100 |
---|---|---|
committer | Johannes Berg <johannes.berg@intel.com> | 2015-12-02 22:27:53 +0100 |
commit | c1df932c0574c13ab3ce72e969c9647ff3aaad68 (patch) | |
tree | 837ad522ed41b46dddc5eb88bf7ed26b3bb6b477 /net/rfkill | |
parent | mac80211: do not actively scan DFS channels (diff) | |
download | linux-c1df932c0574c13ab3ce72e969c9647ff3aaad68.tar.xz linux-c1df932c0574c13ab3ce72e969c9647ff3aaad68.zip |
mac80211: fix off-channel mgmt-tx uninitialized variable usage
In the last change here, I neglected to update the cookie in one code
path: when a mgmt-tx has no real cookie sent to userspace as it doesn't
wait for a response, but is off-channel. The original code used the SKB
pointer as the cookie and always assigned the cookie to the TX SKB in
ieee80211_start_roc_work(), but my change turned this around and made
the code rely on a valid cookie being passed in.
Unfortunately, the off-channel no-wait TX path wasn't assigning one at
all, resulting in an uninitialized stack value being used. This wasn't
handed back to userspace as a cookie (since in the no-wait case there
isn't a cookie), but it was tested for non-zero to distinguish between
mgmt-tx and off-channel.
Fix this by assigning a dummy non-zero cookie unconditionally, and get
rid of a misleading comment and some dead code while at it. I'll clean
up the ACK SKB handling separately later.
Fixes: 3b79af973cf4 ("mac80211: stop using pointers as userspace cookies")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/rfkill')
0 files changed, 0 insertions, 0 deletions