ath9k_htc: Fix bug in aggregation initiation

Accessing the sta pointer in TX completion without
approprate RCU protection is wrong. Fix this.

Also, RCU protection is needed when the station's
aggregation state is updated. Handle this properly.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 12 insertions, 2 deletions

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 94e299fabbb2..838365607aa5 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -188,10 +188,20 @@ void ath9k_tx_tasklet(unsigned long data)
                 hdr = (struct ieee80211_hdr *) skb->data;
                 fc = hdr->frame_control;
                 tx_info = IEEE80211_SKB_CB(skb);
-                sta = tx_info->control.sta;
+
+                memset(&tx_info->status, 0, sizeof(tx_info->status));
 
                 rcu_read_lock();
 
+                sta = ieee80211_find_sta(priv->vif, hdr->addr1);
+                if (!sta) {
+                        rcu_read_unlock();
+                        ieee80211_tx_status(priv->hw, skb);
+                        continue;
+                }
+
+                /* Check if we need to start aggregation */
+
                 if (sta && conf_is_ht(&priv->hw->conf) &&
                     (priv->op_flags & OP_TXAGGR)
                     && !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
@@ -213,7 +223,7 @@ void ath9k_tx_tasklet(unsigned long data)
 
                 rcu_read_unlock();
 
-                memset(&tx_info->status, 0, sizeof(tx_info->status));
+                /* Send status to mac80211 */
                 ieee80211_tx_status(priv->hw, skb);
         }
 }