From 0a557ed3a0a4f7e36d76da137b781344f548c464 Mon Sep 17 00:00:00 2001 From: Eliad Peller Date: Tue, 19 Jul 2011 13:14:42 +0300 Subject: mac80211: check sta_info_get() return value ieee80211_stop_rx_ba_session() was calling sta_info_get() without rcu locking, and the return value was not checked. This resulted in the following panic: [] (ieee80211_stop_rx_ba_session+0x0/0x60 [mac80211]) [] (wl1271_event_handle+0x0/0xdc8 [wl12xx]) [] (wl1271_irq+0x0/0x4a0 [wl12xx]) [] (irq_thread+0x0/0x254) [] (kthread+0x0/0x8c) Signed-off-by: Eliad Peller Reviewed-by: Johannes Berg Signed-off-by: John W. Linville --- net/mac80211/agg-rx.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'net/mac80211/agg-rx.c') diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c index ebadb9ac9a7e..fd1aaf2a4a6c 100644 --- a/net/mac80211/agg-rx.c +++ b/net/mac80211/agg-rx.c @@ -104,14 +104,22 @@ void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap, const u8 *addr) { struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); - struct sta_info *sta = sta_info_get(sdata, addr); + struct sta_info *sta; int i; + rcu_read_lock(); + sta = sta_info_get(sdata, addr); + if (!sta) { + rcu_read_unlock(); + return; + } + for (i = 0; i < STA_TID_NUM; i++) if (ba_rx_bitmap & BIT(i)) set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested); ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work); + rcu_read_unlock(); } EXPORT_SYMBOL(ieee80211_stop_rx_ba_session); -- cgit v1.2.3-59-g8ed1b