wl12xx: handle injected packets

Injected packets are sent with no vif, causing the wl12xx
to NULL-dereference in multiple places.

Furthermore, injected packets are currently not sent at all,
as system_hlid doesn't belong to any specific role, so
wl1271_skb_dequeue() never return its packets.

Handle both these problems.

Reported-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index a2d16933ccb0e479636d5f5d0cc5d627630975b9..f76be5ad8ab093568dd3c7e7027d8a4bcb5420d9 100644 (file)
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -1477,11 +1477,14 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
        struct wl1271 *wl = hw->priv;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct ieee80211_vif *vif = info->control.vif;
-       struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+       struct wl12xx_vif *wlvif = NULL;
        unsigned long flags;
        int q, mapping;
        u8 hlid;
 
+       if (vif)
+               wlvif = wl12xx_vif_to_data(vif);
+
        mapping = skb_get_queue_mapping(skb);
        q = wl1271_tx_get_queue(mapping);
 
@@ -1491,7 +1494,7 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 
        /* queue the packet */
        if (hlid == WL12XX_INVALID_LINK_ID ||
-           !test_bit(hlid, wlvif->links_map)) {
+           (wlvif && !test_bit(hlid, wlvif->links_map))) {
                wl1271_debug(DEBUG_TX, "DROP skb hlid %d q %d", hlid, q);
                dev_kfree_skb(skb);
                goto out;

diff --git a/drivers/net/wireless/wl12xx/tx.c b/drivers/net/wireless/wl12xx/tx.c
index 27a45e1459c4e00563d5da66a81c967fe7521a79..c7ad4f5976c59121af04a41e6fbab9c1c3896b61 100644 (file)
--- a/drivers/net/wireless/wl12xx/tx.c
+++ b/drivers/net/wireless/wl12xx/tx.c
@@ -185,7 +185,7 @@ u8 wl12xx_tx_get_hlid(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 {
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
-       if (wl12xx_is_dummy_packet(wl, skb))
+       if (!wlvif || wl12xx_is_dummy_packet(wl, skb))
                return wl->system_hlid;
 
        if (wlvif->bss_type == BSS_TYPE_AP_BSS)
@@ -264,7 +264,8 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                ac = wl1271_tx_get_queue(skb_get_queue_mapping(skb));
                wl->tx_allocated_pkts[ac]++;
 
-               if (!is_dummy && wlvif->bss_type == BSS_TYPE_AP_BSS &&
+               if (!is_dummy && wlvif &&
+                   wlvif->bss_type == BSS_TYPE_AP_BSS &&
                    test_bit(hlid, wlvif->ap.sta_hlid_map))
                        wl->links[hlid].allocated_pkts++;
 
@@ -307,7 +308,7 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
        desc->start_time = cpu_to_le32(hosttime - wl->time_offset);
 
        is_dummy = wl12xx_is_dummy_packet(wl, skb);
-       if (is_dummy || wlvif->bss_type != BSS_TYPE_AP_BSS)
+       if (is_dummy || !wlvif || wlvif->bss_type != BSS_TYPE_AP_BSS)
                desc->life_time = cpu_to_le16(TX_HW_MGMT_PKT_LIFETIME_TU);
        else
                desc->life_time = cpu_to_le16(TX_HW_AP_MODE_PKT_LIFETIME_TU);
@@ -326,14 +327,14 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                           TX_HW_ATTR_SESSION_COUNTER;
 
                tx_attr |= TX_HW_ATTR_TX_DUMMY_REQ;
-       } else {
+       } else if (wlvif) {
                /* configure the tx attributes */
                tx_attr = wlvif->session_counter <<
                          TX_HW_ATTR_OFST_SESSION_COUNTER;
        }
 
        desc->hlid = hlid;
-       if (is_dummy)
+       if (is_dummy || !wlvif)
                rate_idx = 0;
        else if (wlvif->bss_type != BSS_TYPE_AP_BSS) {
                /* if the packets are destined for AP (have a STA entry)
@@ -446,7 +447,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
        wl1271_tx_fill_hdr(wl, wlvif, skb, extra, info, hlid);
 
-       if (!is_dummy && wlvif->bss_type == BSS_TYPE_AP_BSS) {
+       if (!is_dummy && wlvif && wlvif->bss_type == BSS_TYPE_AP_BSS) {
                wl1271_tx_ap_update_inconnection_sta(wl, skb);
                wl1271_tx_regulate_link(wl, wlvif, hlid);
        }
@@ -623,6 +624,9 @@ static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl)
                }
        }
 
+       if (!skb)
+               skb = wl12xx_lnk_skb_dequeue(wl, &wl->links[wl->system_hlid]);
+
        if (!skb &&
            test_and_clear_bit(WL1271_FLAG_DUMMY_PACKET_PENDING, &wl->flags)) {
                int q;
@@ -716,19 +720,14 @@ void wl1271_tx_work_locked(struct wl1271 *wl)
                return;
 
        while ((skb = wl1271_skb_dequeue(wl))) {
+               struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                bool has_data = false;
 
                wlvif = NULL;
-               if (!wl12xx_is_dummy_packet(wl, skb)) {
-                       struct ieee80211_tx_info *info;
-                       struct ieee80211_vif *vif;
+               if (!wl12xx_is_dummy_packet(wl, skb) && info->control.vif)
+                       wlvif = wl12xx_vif_to_data(info->control.vif);
 
-                       info = IEEE80211_SKB_CB(skb);
-                       vif = info->control.vif;
-                       wlvif = wl12xx_vif_to_data(vif);
-               }
                has_data = wlvif && wl1271_tx_is_data_present(skb);
-
                ret = wl1271_prepare_tx_frame(wl, wlvif, skb, buf_offset);
                if (ret == -EAGAIN) {
                        /*