Skip to content

Commit

Permalink
ath: prevent panic in ieee80211_beacon_update() #190
Browse files Browse the repository at this point in the history
  • Loading branch information
@fichtner
fichtner committed Nov 27, 2023
1 parent b47b740 commit ad8f010
Showing 1 changed file with 22 additions and 12 deletions.
34 changes: 22 additions & 12 deletions sys/dev/ath/if_ath_beacon.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -701,7 +701,6 @@ ath_beacon_generate(struct ath_softc *sc, struct ieee80211vap *vap)
struct ath_vap *avp = ATH_VAP(vap);
struct ath_txq *cabq = sc->sc_cabq;
struct ath_buf *bf;
struct mbuf *m;
int nmcastq, error;

KASSERT(vap->iv_state >= IEEE80211_S_RUN,
Expand All @@ -715,16 +714,22 @@ ath_beacon_generate(struct ath_softc *sc, struct ieee80211vap *vap)
* of the TIM bitmap).
*/
bf = avp->av_bcbuf;
m = bf->bf_m;

if (bf->bf_m == NULL) {
bf->bf_m = ieee80211_beacon_alloc(bf->bf_node);
if (bf->bf_m == NULL) {
return NULL;
}
}

/* XXX lock mcastq? */
nmcastq = avp->av_mcastq.axq_depth;

if (ieee80211_beacon_update(bf->bf_node, m, nmcastq)) {
if (ieee80211_beacon_update(bf->bf_node, bf->bf_m, nmcastq)) {
/* XXX too conservative? */
bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
error = bus_dmamap_load_mbuf_sg(sc->sc_dmat, bf->bf_dmamap, m,
bf->bf_segs, &bf->bf_nseg,
BUS_DMA_NOWAIT);
error = bus_dmamap_load_mbuf_sg(sc->sc_dmat, bf->bf_dmamap,
bf->bf_m, bf->bf_segs, &bf->bf_nseg, BUS_DMA_NOWAIT);
if (error != 0) {
if_printf(vap->iv_ifp,
"%s: bus_dmamap_load_mbuf_sg failed, error %u\n",
Expand Down Expand Up @@ -827,7 +832,6 @@ ath_beacon_start_adhoc(struct ath_softc *sc, struct ieee80211vap *vap)
struct ath_vap *avp = ATH_VAP(vap);
struct ath_hal *ah = sc->sc_ah;
struct ath_buf *bf;
struct mbuf *m;
int error;

KASSERT(avp->av_bcbuf != NULL, ("no beacon buffer"));
Expand All @@ -839,13 +843,19 @@ ath_beacon_start_adhoc(struct ath_softc *sc, struct ieee80211vap *vap)
* of the TIM bitmap).
*/
bf = avp->av_bcbuf;
m = bf->bf_m;
if (ieee80211_beacon_update(bf->bf_node, m, 0)) {

if (bf->bf_m == NULL) {
bf->bf_m = ieee80211_beacon_alloc(bf->bf_node);
if (bf->bf_m == NULL) {
return;
}
}

if (ieee80211_beacon_update(bf->bf_node, bf->bf_m, 0)) {
/* XXX too conservative? */
bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
error = bus_dmamap_load_mbuf_sg(sc->sc_dmat, bf->bf_dmamap, m,
bf->bf_segs, &bf->bf_nseg,
BUS_DMA_NOWAIT);
error = bus_dmamap_load_mbuf_sg(sc->sc_dmat, bf->bf_dmamap,
bf->bf_m, bf->bf_segs, &bf->bf_nseg, BUS_DMA_NOWAIT);
if (error != 0) {
if_printf(vap->iv_ifp,
"%s: bus_dmamap_load_mbuf_sg failed, error %u\n",
Expand Down

0 comments on commit ad8f010

Please sign in to comment.