Avoid freeing the last request while it is being processed. This can
happen in some cases if reg_work is kicked for some reason while the
currently pending request is in flight.
Signed-off-by: Arik Nemtsov <arik@xxxxxxxxxx>
---
This is to be applied on top of
"cfg80211: fix processing world regdomain when non modular"
net/wireless/reg.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f59aaac..5ec04dc 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -240,8 +240,16 @@ static char user_alpha2[2];
module_param(ieee80211_regdom, charp, 0444);
MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
-static void reg_free_request(struct regulatory_request *lr)
+static void reg_free_request(struct regulatory_request *request)
{
+ if (request != get_last_request())
+ kfree(request);
+}
+
+static void reg_free_last_request(void)
+{
+ struct regulatory_request *lr = get_last_request();
+
if (lr != &core_request_world && lr)
kfree_rcu(lr, rcu_head);
}
@@ -254,7 +262,7 @@ static void reg_update_last_request(struct regulatory_request *request)
if (lr == request)
return;
- reg_free_request(lr);
+ reg_free_last_request();
rcu_assign_pointer(last_request, request);
}
@@ -1616,7 +1624,7 @@ reg_process_hint_user(struct regulatory_request *user_request)
treatment = __reg_process_hint_user(user_request);
if (treatment == REG_REQ_IGNORE ||
treatment == REG_REQ_ALREADY_SET) {
- kfree(user_request);
+ reg_free_request(user_request);
return treatment;
}
@@ -1676,14 +1684,14 @@ reg_process_hint_driver(struct wiphy *wiphy,
case REG_REQ_OK:
break;
case REG_REQ_IGNORE:
- kfree(driver_request);
+ reg_free_request(driver_request);
return treatment;
case REG_REQ_INTERSECT:
/* fall through */
case REG_REQ_ALREADY_SET:
regd = reg_copy_regd(get_cfg80211_regdom());
if (IS_ERR(regd)) {
- kfree(driver_request);
+ reg_free_request(driver_request);
return REG_REQ_IGNORE;
}
rcu_assign_pointer(wiphy->regd, regd);
@@ -1777,10 +1785,10 @@ reg_process_hint_country_ie(struct wiphy *wiphy,
case REG_REQ_IGNORE:
/* fall through */
case REG_REQ_ALREADY_SET:
- kfree(country_ie_request);
+ reg_free_request(country_ie_request);
return treatment;
case REG_REQ_INTERSECT:
- kfree(country_ie_request);
+ reg_free_request(country_ie_request);
/*
* This doesn't happen yet, not sure we
* ever want to support it for this case.
@@ -1841,7 +1849,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
return;
out_free:
- kfree(reg_request);
+ reg_free_request(reg_request);
}
/*
--
1.8.1.2
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
