mac80211: fix off-channel mgmt-tx uninitialized variable usage
In the last change here, I neglected to update the cookie in one code
path: when a mgmt-tx has no real cookie sent to userspace as it doesn't
wait for a response, but is off-channel. The original code used the SKB
pointer as the cookie and always assigned the cookie to the TX SKB in
ieee80211_start_roc_work(), but my change turned this around and made
the code rely on a valid cookie being passed in.
Unfortunately, the off-channel no-wait TX path wasn't assigning one at
all, resulting in an uninitialized stack value being used. This wasn't
handed back to userspace as a cookie (since in the no-wait case there
isn't a cookie), but it was tested for non-zero to distinguish between
mgmt-tx and off-channel.
Fix this by assigning a dummy non-zero cookie unconditionally, and get
rid of a misleading comment and some dead code while at it. I'll clean
up the ACK SKB handling separately later.
Fixes: 3b79af973c
("mac80211: stop using pointers as userspace cookies")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
parent
4e39ccac0d
commit
c1df932c05
|
@ -3454,8 +3454,12 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
|
|||
goto out_unlock;
|
||||
}
|
||||
} else {
|
||||
/* for cookie below */
|
||||
ack_skb = skb;
|
||||
/* Assign a dummy non-zero cookie, it's not sent to
|
||||
* userspace in this case but we rely on its value
|
||||
* internally in the need_offchan case to distinguish
|
||||
* mgmt-tx from remain-on-channel.
|
||||
*/
|
||||
*cookie = 0xffffffff;
|
||||
}
|
||||
|
||||
if (!need_offchan) {
|
||||
|
|
Loading…
Reference in a new issue