Commit 087baf9b authored Dec 03, 2021 by Ryder Lee Committed by Felix Fietkau Dec 19, 2021

mt76: only access ieee80211_hdr after mt76_insert_ccmp_hdr



Get rid of unsafe access since mt76_insert_ccmp_hdr moves the header.

Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

parent d43de9cf

drivers/net/wireless/mediatek/mt76/mt7915/mac.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -777,7 +777,7 @@ mt7915_mac_fill_rx(struct mt7915_dev dev, struct sk_buff skb)
		}

		if (!hdr_trans) {
		struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
		struct ieee80211_hdr *hdr;

		if (insert_ccmp_hdr) {
		u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1);
		@@ -785,6 +785,7 @@ mt7915_mac_fill_rx(struct mt7915_dev dev, struct sk_buff skb)
		mt76_insert_ccmp_hdr(skb, key_id);
		}

		hdr = mt76_skb_get_hdr(skb);
		fc = hdr->frame_control;
		if (ieee80211_is_data_qos(fc)) {
		seq_ctrl = le16_to_cpu(hdr->seq_ctrl);

drivers/net/wireless/mediatek/mt76/mt7921/mac.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -772,7 +772,7 @@ mt7921_mac_fill_rx(struct mt7921_dev dev, struct sk_buff skb)
		}

		if (!hdr_trans) {
		struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
		struct ieee80211_hdr *hdr;

		if (insert_ccmp_hdr) {
		u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1);