[patch] d80211: fix crash in ieee80211_rx_michael_mic_report()

[patch] d80211: fix crash in ieee80211_rx_michael_mic_report()

[David Kimdon]

[-- Attachment #1: michael_mic_failure_crash.patch --]
[-- Type: text/plain, Size: 1168 bytes --]

This fixes a crash at ieee80211.c line 3461, ieee80211_rx_michael_mic_report()
(rx->sdata->type == IEEE80211_IF_TYPE_AP).  rx.sdata needs to be set before
calling ieee80211_rx_michael_mic_report().

Signed-off-by: Elliot Schwartz <elliot@devicescape.com>
Signed-off-by: David Kimdon <david.kimdon@devicescape.com>

Index: wireless-dev/net/d80211/ieee80211.c
===================================================================
--- wireless-dev.orig/net/d80211/ieee80211.c
+++ wireless-dev/net/d80211/ieee80211.c
@@ -3582,6 +3582,11 @@ void __ieee80211_rx(struct net_device *d
 	else
 		sta = rx.sta = NULL;
 
+	if (sta) {
+		rx.dev = sta->dev;
+		rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
+	}
+
         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
 		ieee80211_rx_michael_mic_report(dev, hdr, sta, &rx);
 		goto end;
@@ -3597,8 +3602,6 @@ void __ieee80211_rx(struct net_device *d
 
 	if (sta && !sta->assoc_ap && !(sta->flags & WLAN_STA_WDS) &&
 	    !local->iff_promiscs && !multicast) {
-		rx.dev = sta->dev;
-		rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
 		rx.u.rx.ra_match = 1;
 		ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
 					     sta);

--