Search Linux Wireless

Re: [RFC] mac80211: fix possible tid_rx->reorder_timer use after free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 2012-03-19 at 14:40 +0100, Stanislaw Gruszka wrote:

> > > +static void ieee80211_free_tid_rx(struct tid_ampdu_rx *tid_rx)
> > >  {
> > > -	struct tid_ampdu_rx *tid_rx =
> > > -		container_of(h, struct tid_ampdu_rx, rcu_head);
> > >  	int i;
> > >  
> > >  	for (i = 0; i < tid_rx->buf_size; i++)
> > > @@ -90,10 +88,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
> > >  		ieee80211_send_delba(sta->sdata, sta->sta.addr,
> > >  				     tid, WLAN_BACK_RECIPIENT, reason);
> > >  
> > > +	synchronize_rcu();
> > > +
> > >  	del_timer_sync(&tid_rx->session_timer);
> > >  	del_timer_sync(&tid_rx->reorder_timer);
> > >  
> > > -	call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
> > > +	ieee80211_free_tid_rx(tid_rx);
> > 
> > Hmmm. That synchronize_rcu() could become rather expensive. I've been
> > trying to reduce our use of synchronize_rcu() now.
> 
> Expensive in what sense? Since we are in process context we are allowed
> to sleep, and some other processes will run while we sleep.

It takes a long time, and we have to wait for it. So for example, it
could delay roaming by another 100ms or however long it takes (yes, it
can take a very long time, we've seen up to 200ms I think)

johannes

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux