On Thu, 2011-12-08 at 12:11 +0530, Yogesh Ashok Powar wrote: > When a station leaves suddenly while ampdu traffic to that station is still > running, there is a possibility that the ampdu pending queues are not freed due > to a race condition leading to memory leaks. In '__sta_info_destroy' when we > attempt to destroy the ampdu sessions in 'ieee80211_sta_tear_down_BA_sessions', > the driver calls 'ieee80211_stop_tx_ba_cb_irqsafe' to delete the ampdu > structures (tid_tx) and splice the pending queues and this job gets queued in > sdata workqueue. However, the sta entry can get destroyed before the above work > gets scheduled and hence the race. There isn't even a requirement to call tx_ba_cb[_irqsafe]() right away, so it's not just that race ... but anyway, I guess we cope with this today so cleaning the frames is good. Maybe you could add documentation somewhere that it is possible for a station to be freed before the BA teardown completes? Just as a note for driver authors. johannes -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
