staging: wfx: fix possible panic with re-queued frames

Browse source

When the firmware rejects a frame (because station become asleep or
disconnected), the frame is re-queued in mac80211. However, the
re-queued frame was 8 bytes longer than the original one (the size of
the ICV for the encryption). So, when mac80211 try to send this frame
again, it is a little bigger than expected.
If the frame is re-queued secveral time it end with a skb_over_panic
because the skb buffer is not large enough.

Note it only happens when device acts as an AP and encryption is
enabled.

This patch more or less reverts the commit 049fde1304 ("staging: wfx:
drop useless field from struct wfx_tx_priv").

Fixes: 049fde1304 ("staging: wfx: drop useless field from struct wfx_tx_priv")
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20210208135254.399964-1-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Jérôme Pouiller 2021-02-08 14:52:54 +01:00 • committed by Greg Kroah-Hartman

parent dc72a882b2

commit 26df933d9b

2 changed files with 10 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

drivers/staging/wfx/data_tx.c

View file

1

drivers/staging/wfx/data_tx.h

View file