On Wed, 02 Apr 2025 23:27:14 +0530, P Praneesh wrote:
> The struct sk_buff's control buffer is shared by mac80211's struct
> ieee80211_tx_info and ath12k's struct ath12k_skb_cb. When the driver wants
> to transmit an skb, it caches all the mac80211-specific information from
> struct ieee80211_tx_info, then performs a memset on the control buffer
> before writing the ath12k-specific information using struct ath12k_skb_cb.
> However, during multicast tx, the key is being filled into the driver data,
> which overwrites some crucial members like link_id and flags in struct
> ath12k_skb_cb. This causes invalid information retrieval when the driver
> accesses these fields during ath12k_dp_tx(). Fix this issue by removing
> the key filling logic during MLO multicast tx, as it is not used anywhere
> in the tx path.
>
> [...]
Applied, thanks!
[1/1] wifi: ath12k: Fix memory corruption during MLO multicast tx
commit: 6f8a27a584b23e9dedefd6cb110dd2587b84a6d4
Best regards,
--
Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx>
