• Johannes Berg's avatar
    mac80211: fix off-channel mgmt-tx uninitialized variable usage · c1df932c
    Johannes Berg authored
    In the last change here, I neglected to update the cookie in one code
    path: when a mgmt-tx has no real cookie sent to userspace as it doesn't
    wait for a response, but is off-channel. The original code used the SKB
    pointer as the cookie and always assigned the cookie to the TX SKB in
    ieee80211_start_roc_work(), but my change turned this around and made
    the code rely on a valid cookie being passed in.
    
    Unfortunately, the off-channel no-wait TX path wasn't assigning one at
    all, resulting in an uninitialized stack value being used. This wasn't
    handed back to userspace as a cookie (since in the no-wait case there
    isn't a cookie), but it was tested for non-zero to distinguish between
    mgmt-tx and off-channel.
    
    Fix this by assigning a dummy non-zero cookie unconditionally, and get
    rid of a misleading comment and some dead code while at it. I'll clean
    up the ACK SKB handling separately later.
    
    Fixes: 3b79af97 ("mac80211: stop using pointers as userspace cookies")
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    c1df932c
cfg.c 102 KB