055249d20d
It was possible to hit a kernel panic on NULL pointer dereference in dev_queue_xmit() when sending power save buffered frames to a STA that woke up from sleep. This happened when the buffered frame was requeued for transmission in ap_sta_ps_end(). In order to avoid the panic, copy the skb->dev and skb->iif values from the first fragment to all other fragments. Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| aes_ccm.c | ||
| aes_ccm.h | ||
| cfg.c | ||
| cfg.h | ||
| debugfs.c | ||
| debugfs.h | ||
| debugfs_key.c | ||
| debugfs_key.h | ||
| debugfs_netdev.c | ||
| debugfs_netdev.h | ||
| debugfs_sta.c | ||
| debugfs_sta.h | ||
| event.c | ||
| ht.c | ||
| ieee80211_i.h | ||
| iface.c | ||
| key.c | ||
| key.h | ||
| led.c | ||
| led.h | ||
| main.c | ||
| mesh.c | ||
| mesh.h | ||
| mesh_hwmp.c | ||
| mesh_pathtbl.c | ||
| mesh_plink.c | ||
| michael.c | ||
| michael.h | ||
| mlme.c | ||
| rate.c | ||
| rate.h | ||
| rc80211_minstrel.c | ||
| rc80211_minstrel.h | ||
| rc80211_minstrel_debugfs.c | ||
| rc80211_pid.h | ||
| rc80211_pid_algo.c | ||
| rc80211_pid_debugfs.c | ||
| rx.c | ||
| scan.c | ||
| spectmgmt.c | ||
| sta_info.c | ||
| sta_info.h | ||
| tkip.c | ||
| tkip.h | ||
| tx.c | ||
| util.c | ||
| wep.c | ||
| wep.h | ||
| wext.c | ||
| wme.c | ||
| wme.h | ||
| wpa.c | ||
| wpa.h | ||