From 5ea5196eeaa68b55247f37af1ae893f77df5af57 Mon Sep 17 00:00:00 2001 From: Shen Mintao Date: Fri, 7 Aug 2026 16:12:28 +0800 Subject: [PATCH] fix: prevent monitor RX null dereference Do not send monitor frames through the normal data path when simultaneous monitor/data support is disabled. Handle monitor skb allocation failures without dereferencing NULL or dropping the original combined-mode frame. Fixes #83 (cherry picked from commit 531d16c4d6799726254e1e770d1f8bea355cf97e) --- drivers/aic8800/aic8800_fdrv/rwnx_rx.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/drivers/aic8800/aic8800_fdrv/rwnx_rx.c b/drivers/aic8800/aic8800_fdrv/rwnx_rx.c index 4f95335..565b138 100644 --- a/drivers/aic8800/aic8800_fdrv/rwnx_rx.c +++ b/drivers/aic8800/aic8800_fdrv/rwnx_rx.c @@ -2283,6 +2283,11 @@ u8 rwnx_rxdataind_aicwf(struct rwnx_hw *rwnx_hw, void *hostid, void *rx_priv) if(hw_rxhdr->flags_upload) status |= RX_STAT_FORWARD; +#ifndef CONFIG_RWNX_MON_DATA + if (status & RX_STAT_MONITOR) + status &= ~RX_STAT_FORWARD; +#endif + /* Check if we need to delete the buffer */ if (status & RX_STAT_DELETE) { /* Remove the SK buffer from the rxbuf_elems table */ @@ -2345,13 +2350,24 @@ u8 rwnx_rxdataind_aicwf(struct rwnx_hw *rwnx_hw, void *hostid, void *rx_priv) } else { #ifdef CONFIG_RWNX_MON_DATA skb_monitor = skb_copy_expand(skb, rtap_len, 0, GFP_ATOMIC); - skb_monitor->data += (msdu_offset + 2); //sdio/usb word allign + if (skb_monitor) { + skb_monitor->data += (msdu_offset + 2); //sdio/usb word allign - //Save frame length - frm_len = le32_to_cpu(hw_rxhdr->hwvect.len); + //Save frame length + frm_len = le32_to_cpu(hw_rxhdr->hwvect.len); + } #endif } + if (!skb_monitor) { + if (status == RX_STAT_MONITOR) { + dev_kfree_skb(skb); + goto end; + } + + goto check_len_update; + } + //skb_reset_tail_pointer(skb); //skb->len = 0; skb_reset_tail_pointer(skb_monitor);