mirror of
https://github.com/torvalds/linux.git
synced 2026-10-17 05:32:09 +02:00
98aff74779
mt7615_tx() falls back to the vif BSS wcid when mac80211 hands a frame over without a station, e.g. while a station is being torn down, and to the global wcid when there is no vif either. Both tx_prepare_skb implementations derive a mt7615_sta from that wcid unconditionally and, if the rate control probe flag is set, pass it to mt7615_mac_set_rates(), which dereferences the NULL vif backpointer of the per-vif embedded sta: Unable to handle kernel read from unreadable memory at virtual address 0000000000000002 ... pc : mt7615_mac_set_rates lr : mt7615_tx_prepare_skb Neither entry is rate controlled by mac80211: the embedded sta has an empty rate set, and for the global wcid the container_of does not yield a valid mt7615_sta at all. Only resolve the sta for wcids that belong to a station. Reported-by: Chad Monroe <chad@monroe.io> Link: https://patch.msgid.link/20260724124813.3961474-23-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name> |
||
|---|---|---|
| .. | ||
| debugfs.c | ||
| dma.c | ||
| eeprom.c | ||
| eeprom.h | ||
| init.c | ||
| Kconfig | ||
| mac.c | ||
| mac.h | ||
| main.c | ||
| Makefile | ||
| mcu.c | ||
| mcu.h | ||
| mmio.c | ||
| mt7615_trace.h | ||
| mt7615.h | ||
| pci_init.c | ||
| pci_mac.c | ||
| pci.c | ||
| regs.h | ||
| sdio_mcu.c | ||
| sdio.c | ||
| soc.c | ||
| testmode.c | ||
| trace.c | ||
| usb_mcu.c | ||
| usb_sdio.c | ||
| usb.c | ||