drivers/aic8800d80
1
0
Fork 0
mirror of https://github.com/shenmintao/aic8800d80.git synced 2026-09-26 17:44:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent monitor RX null dereference

Browse Source 
Do not send monitor frames through the normal data path when simultaneous monitor/data support is disabled. Handle monitor skb allocation failures without dereferencing NULL or dropping the original combined-mode frame.

Fixes #83

(cherry picked from commit 531d16c4d6)
This commit is contained in:
Shen Mintao
2026-08-07 16:15:55 +08:00
parent fffad12a26
commit 5ea5196eea
1 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/aic8800/aic8800_fdrv/rwnx_rx.c
+16
View File
@@ -2283,6 +2283,11 @@ u8 rwnx_rxdataind_aicwf(struct rwnx_hw *rwnx_hw, void *hostid, void *rx_priv)
if(hw_rxhdr->flags_upload) if(hw_rxhdr->flags_upload)
status |= RX_STAT_FORWARD; status |= RX_STAT_FORWARD;
#ifndef CONFIG_RWNX_MON_DATA
if (status & RX_STAT_MONITOR)
status &= ~RX_STAT_FORWARD;
#endif
/* Check if we need to delete the buffer */ /* Check if we need to delete the buffer */
if (status & RX_STAT_DELETE) { if (status & RX_STAT_DELETE) {
/* Remove the SK buffer from the rxbuf_elems table */ /* Remove the SK buffer from the rxbuf_elems table */
@@ -2345,13 +2350,24 @@ u8 rwnx_rxdataind_aicwf(struct rwnx_hw *rwnx_hw, void *hostid, void *rx_priv)
} else { } else {
#ifdef CONFIG_RWNX_MON_DATA #ifdef CONFIG_RWNX_MON_DATA
skb_monitor = skb_copy_expand(skb, rtap_len, 0, GFP_ATOMIC); skb_monitor = skb_copy_expand(skb, rtap_len, 0, GFP_ATOMIC);
if (skb_monitor) {
skb_monitor->data += (msdu_offset + 2); //sdio/usb word allign skb_monitor->data += (msdu_offset + 2); //sdio/usb word allign
//Save frame length //Save frame length
frm_len = le32_to_cpu(hw_rxhdr->hwvect.len); frm_len = le32_to_cpu(hw_rxhdr->hwvect.len);
}
#endif #endif
} }
if (!skb_monitor) {
if (status == RX_STAT_MONITOR) {
dev_kfree_skb(skb);
goto end;
}
goto check_len_update;
}
//skb_reset_tail_pointer(skb); //skb_reset_tail_pointer(skb);
//skb->len = 0; //skb->len = 0;
skb_reset_tail_pointer(skb_monitor); skb_reset_tail_pointer(skb_monitor);