linux/net/mac80211
Johannes Berg c1df932c05 mac80211: fix off-channel mgmt-tx uninitialized variable usage
In the last change here, I neglected to update the cookie in one code
path: when a mgmt-tx has no real cookie sent to userspace as it doesn't
wait for a response, but is off-channel. The original code used the SKB
pointer as the cookie and always assigned the cookie to the TX SKB in
ieee80211_start_roc_work(), but my change turned this around and made
the code rely on a valid cookie being passed in.

Unfortunately, the off-channel no-wait TX path wasn't assigning one at
all, resulting in an uninitialized stack value being used. This wasn't
handed back to userspace as a cookie (since in the no-wait case there
isn't a cookie), but it was tested for non-zero to distinguish between
mgmt-tx and off-channel.

Fix this by assigning a dummy non-zero cookie unconditionally, and get
rid of a misleading comment and some dead code while at it. I'll clean
up the ACK SKB handling separately later.

Fixes: 3b79af973c ("mac80211: stop using pointers as userspace cookies")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-12-02 22:27:53 +01:00
..
aes_ccm.c
aes_ccm.h
aes_cmac.c
aes_cmac.h
aes_gcm.c
aes_gcm.h
aes_gmac.c
aes_gmac.h
agg-rx.c
agg-tx.c
cfg.c
chan.c
debug.h
debugfs_key.c
debugfs_key.h
debugfs_netdev.c
debugfs_netdev.h
debugfs_sta.c
debugfs_sta.h
debugfs.c
debugfs.h
driver-ops.c
driver-ops.h
ethtool.c
ht.c
ibss.c
ieee80211_i.h
iface.c
Kconfig
key.c
key.h
led.c
led.h
main.c
Makefile
mesh_hwmp.c
mesh_pathtbl.c
mesh_plink.c
mesh_ps.c
mesh_sync.c
mesh.c
mesh.h
michael.c
michael.h
mlme.c
ocb.c
offchannel.c
pm.c
rate.c
rate.h
rc80211_minstrel_debugfs.c
rc80211_minstrel_ht_debugfs.c
rc80211_minstrel_ht.c
rc80211_minstrel_ht.h
rc80211_minstrel.c
rc80211_minstrel.h
rx.c
scan.c
spectmgmt.c
sta_info.c
sta_info.h
status.c
tdls.c
tkip.c
tkip.h
trace_msg.h
trace.c
trace.h
tx.c
util.c
vht.c
wep.c
wep.h
wme.c
wme.h
wpa.c
wpa.h