package/mac80211/patches/580-mac80211_tx_status_crash.patch

   1 --- a/net/mac80211/status.c
   2 +++ b/net/mac80211/status.c
   3 @@ -517,6 +517,8 @@ void ieee80211_tx_status(struct ieee8021
   4
   5         if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
   6                 u64 cookie = (unsigned long)skb;
   7 +               bool found = false;
   8 +
   9                 acked = info->flags & IEEE80211_TX_STAT_ACK;
  10
  11                 /*
  12 @@ -524,8 +526,18 @@ void ieee80211_tx_status(struct ieee8021
  13                  * we cannot use skb->dev->ieee80211_ptr
  14                  */
  15
  16 -               if (ieee80211_is_nullfunc(hdr->frame_control) ||
  17 -                   ieee80211_is_qos_nullfunc(hdr->frame_control))
  18 +               list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  19 +                       if (skb->dev != sdata->dev)
  20 +                               continue;
  21 +
  22 +                       found = true;
  23 +                       break;
  24 +               }
  25 +
  26 +               if (!found)
  27 +                       skb->dev = NULL;
  28 +               else if (ieee80211_is_nullfunc(hdr->frame_control) ||
  29 +                        ieee80211_is_qos_nullfunc(hdr->frame_control))
  30                         cfg80211_probe_status(skb->dev, hdr->addr1,
  31                                               cookie, acked, GFP_ATOMIC);
  32                 else