• Johannes Berg's avatar
    mac80211: fix tid_agg_rx NULL dereference · 1c3d185a
    Johannes Berg authored
    On drivers setting the SUPPORTS_REORDERING_BUFFER hardware flag,
    we crash when the peer sends an AddBA request while we already
    have a session open on the seame TID; this is because on those
    drivers, the tid_agg_rx is left NULL even though the session is
    valid, and the agg_session_valid bit is set.
    
    To fix this, store the dialog tokens outside the tid_agg_rx to
    be able to compare them to the received AddBA request.
    
    Fixes: f89e07d4 ("mac80211: agg-rx: refuse ADDBA Request with timeout update")
    Reported-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    1c3d185a
sta_info.h 24.9 KB