On Tue, 2011-07-19 at 13:14 +0300, Eliad Peller wrote:
> ieee80211_stop_rx_ba_session() was calling sta_info_get()
> without rcu locking, and the return value was not
> checked.
> This resulted in the following panic:
>
> [<bf05726c>] (ieee80211_stop_rx_ba_session+0x0/0x60 [mac80211])
> [<bf0abd94>] (wl1271_event_handle+0x0/0xdc8 [wl12xx])
> [<bf0a7308>] (wl1271_irq+0x0/0x4a0 [wl12xx])
> [<c00c40a8>] (irq_thread+0x0/0x254)
> [<c00a7398>] (kthread+0x0/0x8c)
Thanks.
Reviewed-by: Johannes Berg <johannes@xxxxxxxxxxxxxxxx>
> Signed-off-by: Eliad Peller <eliad@xxxxxxxxxx>
> ---
> net/mac80211/agg-rx.c | 10 +++++++++-
> 1 files changed, 9 insertions(+), 1 deletions(-)
>
> diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
> index ebadb9a..fd1aaf2 100644
> --- a/net/mac80211/agg-rx.c
> +++ b/net/mac80211/agg-rx.c
> @@ -104,14 +104,22 @@ void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
> const u8 *addr)
> {
> struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
> - struct sta_info *sta = sta_info_get(sdata, addr);
> + struct sta_info *sta;
> int i;
>
> + rcu_read_lock();
> + sta = sta_info_get(sdata, addr);
> + if (!sta) {
> + rcu_read_unlock();
> + return;
> + }
> +
> for (i = 0; i < STA_TID_NUM; i++)
> if (ba_rx_bitmap & BIT(i))
> set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested);
>
> ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
> + rcu_read_unlock();
> }
> EXPORT_SYMBOL(ieee80211_stop_rx_ba_session);
>
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
