On 05/17/2012 02:34 PM, Eliad Peller wrote:
On Thu, May 17, 2012 at 10:47 PM, Johannes Berg
<johannes@xxxxxxxxxxxxxxxx> wrote:
On Thu, 2012-05-17 at 19:06 +0300, Eliad Peller wrote:
cfg80211_dev_free() calls cfg80211_put_bss() directly on all
the remaining bss entries, skipping the proper bss entry
cleanup that usually made by __cfg80211_unlink_bss(), and
leaving the bss_list and the rb_tree with dangling pointers.
list_for_each_entry_safe(scan, tmp,&rdev->bss_list, list)
- cfg80211_put_bss(&scan->pub);
+ cfg80211_unlink_bss(&rdev->wiphy,&scan->pub);
kfree(rdev);
I don't see why we care, we free rdev anyway.
yeah, you have a point here...
we got a crash report for an older kernel with some custom patches,
that indicated a possible write-after-free on the bss release. i was
probably too rushed to blame this code.
Ahhh, as luck would have it..we saw a crash today (in a hacked 3.3.4) that could
be explained by a stale bss reference, so I was all excited by your patch,
thinking I didn't have to go looking for the bug :)
My crash was in an older version of the ethtool-stats logic,
so it could just be my bug, as well....
Thanks,
Ben
--
Ben Greear <greearb@xxxxxxxxxxxxxxx>
Candela Technologies Inc http://www.candelatech.com
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
