mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
mac80211: check sta_info_get() return value
ieee80211_stop_rx_ba_session() was calling sta_info_get() without rcu locking, and the return value was not checked. This resulted in the following panic: [<bf05726c>] (ieee80211_stop_rx_ba_session+0x0/0x60 [mac80211]) [<bf0abd94>] (wl1271_event_handle+0x0/0xdc8 [wl12xx]) [<bf0a7308>] (wl1271_irq+0x0/0x4a0 [wl12xx]) [<c00c40a8>] (irq_thread+0x0/0x254) [<c00a7398>] (kthread+0x0/0x8c) Signed-off-by: Eliad Peller <eliad@wizery.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
5966f2ddcd
commit
0a557ed3a0
1 changed files with 9 additions and 1 deletions
|
@ -104,14 +104,22 @@ void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
|
|||
const u8 *addr)
|
||||
{
|
||||
struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
|
||||
struct sta_info *sta = sta_info_get(sdata, addr);
|
||||
struct sta_info *sta;
|
||||
int i;
|
||||
|
||||
rcu_read_lock();
|
||||
sta = sta_info_get(sdata, addr);
|
||||
if (!sta) {
|
||||
rcu_read_unlock();
|
||||
return;
|
||||
}
|
||||
|
||||
for (i = 0; i < STA_TID_NUM; i++)
|
||||
if (ba_rx_bitmap & BIT(i))
|
||||
set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested);
|
||||
|
||||
ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
|
||||
rcu_read_unlock();
|
||||
}
|
||||
EXPORT_SYMBOL(ieee80211_stop_rx_ba_session);
|
||||
|
||||
|
|
Loading…
Reference in a new issue