diff options
| author | Jérôme Pouiller <jerome.pouiller@silabs.com> | 2021-02-08 14:52:54 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-02-08 15:24:57 +0100 |
| commit | 26df933d9b83ea668304dc4ec641d52ea1fc4091 (patch) | |
| tree | 985c4e9c4e2678f658dfc0df7f6f99e68a5dbee2 /drivers/staging/wfx/data_tx.h | |
| parent | dc72a882b22e5509af90e2c25bbaeca4b17a31fa (diff) | |
staging: wfx: fix possible panic with re-queued frames
When the firmware rejects a frame (because station become asleep or
disconnected), the frame is re-queued in mac80211. However, the
re-queued frame was 8 bytes longer than the original one (the size of
the ICV for the encryption). So, when mac80211 try to send this frame
again, it is a little bigger than expected.
If the frame is re-queued secveral time it end with a skb_over_panic
because the skb buffer is not large enough.
Note it only happens when device acts as an AP and encryption is
enabled.
This patch more or less reverts the commit 049fde130419 ("staging: wfx:
drop useless field from struct wfx_tx_priv").
Fixes: 049fde130419 ("staging: wfx: drop useless field from struct wfx_tx_priv")
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20210208135254.399964-1-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/wfx/data_tx.h')
| -rw-r--r-- | drivers/staging/wfx/data_tx.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/staging/wfx/data_tx.h b/drivers/staging/wfx/data_tx.h index 46c9fff7a870..401363d6b563 100644 --- a/drivers/staging/wfx/data_tx.h +++ b/drivers/staging/wfx/data_tx.h @@ -35,6 +35,7 @@ struct tx_policy_cache { struct wfx_tx_priv { ktime_t xmit_timestamp; + unsigned char icv_size; }; void wfx_tx_policy_init(struct wfx_vif *wvif); |