Search Linux Wireless

Re: [RFT] mac80211: fix null pointer dereference on ieee80211_stop_tx_ba_session()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 2010-10-22 at 20:16 -0700, Luis R. Rodriguez wrote:
> RCU was not being used so we could race against the free'ing of the TID.

>  	spin_lock_bh(&sta->lock);
> -	tid_tx = sta->ampdu_mlme.tid_tx[tid];
> +	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);

As I mentioned to Luis on IRC, I believe that the spinlock is held
across all assignments to ampdu_mlme.tid_tx, so this is definitely not
necessary (nor really correct). If there is a place that doesn't hold
the spinlock that may be a bug, but a cursory look suggested that all
places hold the lock correctly.

johannes

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux