diff options
author | hselasky <hselasky@FreeBSD.org> | 2012-06-02 09:10:51 +0000 |
---|---|---|
committer | hselasky <hselasky@FreeBSD.org> | 2012-06-02 09:10:51 +0000 |
commit | 8bdc66830586800e34b27d5efd68dd80bece881a (patch) | |
tree | e8c0d767c7953dc4794ef9c7af85d7607804aba1 | |
parent | b9a2e94d1d31da7ab851cfc90183f8f5a9a7a5bb (diff) | |
download | FreeBSD-src-8bdc66830586800e34b27d5efd68dd80bece881a.zip FreeBSD-src-8bdc66830586800e34b27d5efd68dd80bece881a.tar.gz |
Add appropriate checks for ic_bsschan being set to IEEE80211_CHAN_ANYC in
some of the USB WLAN drivers. This fixes a panic when using monitor mode.
MFC after: 1 week
Submitted by: PseudoCylon
-rw-r--r-- | sys/dev/usb/wlan/if_rum.c | 11 | ||||
-rw-r--r-- | sys/dev/usb/wlan/if_run.c | 15 | ||||
-rw-r--r-- | sys/dev/usb/wlan/if_ural.c | 13 |
3 files changed, 32 insertions, 7 deletions
diff --git a/sys/dev/usb/wlan/if_rum.c b/sys/dev/usb/wlan/if_rum.c index edd85cc..93e66de 100644 --- a/sys/dev/usb/wlan/if_rum.c +++ b/sys/dev/usb/wlan/if_rum.c @@ -726,6 +726,12 @@ rum_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) ni = ieee80211_ref_node(vap->iv_bss); if (vap->iv_opmode != IEEE80211_M_MONITOR) { + if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) { + RUM_UNLOCK(sc); + IEEE80211_LOCK(ic); + ieee80211_free_node(ni); + return (-1); + } rum_update_slot(ic->ic_ifp); rum_enable_mrr(sc); rum_set_txpreamble(sc); @@ -2135,11 +2141,12 @@ rum_prepare_beacon(struct rum_softc *sc, struct ieee80211vap *vap) if (vap->iv_bss->ni_chan == IEEE80211_CHAN_ANYC) return; + if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) + return; m0 = ieee80211_beacon_alloc(vap->iv_bss, &RUM_VAP(vap)->bo); - if (m0 == NULL) { + if (m0 == NULL) return; - } tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)]; rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ, diff --git a/sys/dev/usb/wlan/if_run.c b/sys/dev/usb/wlan/if_run.c index ddb7395..94ac4ea 100644 --- a/sys/dev/usb/wlan/if_run.c +++ b/sys/dev/usb/wlan/if_run.c @@ -1830,6 +1830,11 @@ run_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) if (vap->iv_opmode != IEEE80211_M_MONITOR) { struct ieee80211_node *ni; + if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) { + RUN_UNLOCK(sc); + IEEE80211_LOCK(ic); + return (-1); + } run_updateslot(ic->ic_ifp); run_enable_mrr(sc); run_set_txpreamble(sc); @@ -2523,8 +2528,8 @@ run_rx_frame(struct run_softc *sc, struct mbuf *m, uint32_t dmalen) struct run_rx_radiotap_header *tap = &sc->sc_rxtap; tap->wr_flags = 0; - tap->wr_chan_freq = htole16(ic->ic_bsschan->ic_freq); - tap->wr_chan_flags = htole16(ic->ic_bsschan->ic_flags); + tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq); + tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags); tap->wr_antsignal = rssi; tap->wr_antenna = ant; tap->wr_dbm_antsignal = run_rssi2dbm(sc, rssi, ant); @@ -2778,8 +2783,8 @@ tr_setup: tap->wt_flags = 0; tap->wt_rate = rt2860_rates[data->ridx].rate; - tap->wt_chan_freq = htole16(vap->iv_bss->ni_chan->ic_freq); - tap->wt_chan_flags = htole16(vap->iv_bss->ni_chan->ic_flags); + tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq); + tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags); tap->wt_hwqueue = index; if (le16toh(txwi->phy) & RT2860_PHY_SHPRE) tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE; @@ -3967,6 +3972,8 @@ run_update_beacon_cb(void *arg) if (vap->iv_bss->ni_chan == IEEE80211_CHAN_ANYC) return; + if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) + return; /* * No need to call ieee80211_beacon_update(), run_update_beacon() diff --git a/sys/dev/usb/wlan/if_ural.c b/sys/dev/usb/wlan/if_ural.c index d1cb91e..60096bd 100644 --- a/sys/dev/usb/wlan/if_ural.c +++ b/sys/dev/usb/wlan/if_ural.c @@ -713,6 +713,12 @@ ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) ni = ieee80211_ref_node(vap->iv_bss); if (vap->iv_opmode != IEEE80211_M_MONITOR) { + if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) { + RAL_UNLOCK(sc); + IEEE80211_LOCK(ic); + ieee80211_free_node(ni); + return (-1); + } ural_update_slot(ic->ic_ifp); ural_set_txpreamble(sc); ural_set_basicrates(sc, ic->ic_bsschan); @@ -1054,7 +1060,12 @@ ural_tx_bcn(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni) ifp->if_drv_flags |= IFF_DRV_OACTIVE; m_freem(m0); ieee80211_free_node(ni); - return EIO; + return (EIO); + } + if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) { + m_freem(m0); + ieee80211_free_node(ni); + return (ENXIO); } data = STAILQ_FIRST(&sc->tx_free); STAILQ_REMOVE_HEAD(&sc->tx_free, next); |