diff options
| author |  Beni Lev <beni.lev@intel.com>
| 2017-07-25 11:25:25 +0300 |
|---|---|---|
| committer |  Johannes Berg <johannes.berg@intel.com>
| 2017-09-05 11:28:52 +0200 |
| commit | 9de981f507474f326e42117858dc9a9321331ae5 (patch) | |
| tree | 0fda5ebbc59f759042823464839eba4b2cf66e0f /drivers/net/wireless | |
| parent | mac80211: Fix null pointer dereference with iTXQ support (diff) | |
| download | linux-9de981f507474f326e42117858dc9a9321331ae5.tar.gz linux-9de981f507474f326e42117858dc9a9321331ae5.tar.bz2 linux-9de981f507474f326e42117858dc9a9321331ae5.zip | |
mac80211_hwsim: Use proper TX power
In struct ieee80211_tx_info, control.vif pointer and rate_driver_data[0]
falls on the same place, depending on the union usage.
During the whole TX process, the union is referred to as a control struct,
which holds the vif that is later used in the tx flow, especially in order
to derive the used tx power.
Referring direcly to rate_driver_data[0] and assigning a value to it,
overwrites the vif pointer, hence making all later references irrelevant.
Moreover, rate_driver_data[0] isn't used later in the flow in order to
retrieve the channel that it is pointing to.
Cc: stable@vger.kernel.org
Signed-off-by: Beni Lev <beni.lev@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/mac80211_hwsim.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index c8852acc1462..6467ffac9811 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -1362,8 +1362,6 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw, txi->control.rates, ARRAY_SIZE(txi->control.rates)); - txi->rate_driver_data[0] = channel; - if (skb->len >= 24 + 8 && ieee80211_is_probe_resp(hdr->frame_control)) { /* fake header transmission time */ |