wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()

commit c98d8836b817d11fdff4ca7749cbbe04ff7f0c64 upstream.

This pointer can change here since the SKB can change, so we
actually later open-coded IEEE80211_SKB_CB() again. Reload
the pointer where needed, so the monitor-mode case using it
gets fixed, and then use info-> later as well.

Cc: stable@vger.kernel.org
Fixes: 531682159092 ("mac80211: fix VLAN handling with TXQs")
Link: https://msgid.link/20240131164910.b54c28d583bc.I29450cec84ea6773cff5d9c16ff92b836c331471@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d5c89c6758f2c2fa8ad24c57e6fcebb77c582a19..481b6b34797da69a55b0bcbfc2f293e597c020fc 100644 (file)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3746,6 +3746,7 @@ begin:
                        goto begin;
 
                skb = __skb_dequeue(&tx.skbs);
+               info = IEEE80211_SKB_CB(skb);
 
                if (!skb_queue_empty(&tx.skbs)) {
                        spin_lock_bh(&fq->lock);
@@ -3790,7 +3791,7 @@ begin:
        }
 
 encap_out:
-       IEEE80211_SKB_CB(skb)->control.vif = vif;
+       info->control.vif = vif;
 
        if (vif &&
            wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {