diff options
| author |   stsp <stsp@openbsd.org> | 2017-01-16 09:35:43 +0000 |
|---|---|---|
| committer | stsp <stsp@openbsd.org> | 2017-01-16 09:35:43 +0000 |
| commit | 1cfdb13a9f2a09f2273db1b3a1d617646ef58ead (patch) | |
| tree | 25432ec78993331470b708e6fcf394a29a88a53f | |
| parent | Prevent wireless frame injection attack described at 33C3 in the talk (diff) | |
| download | wireguard-openbsd-1cfdb13a9f2a09f2273db1b3a1d617646ef58ead.tar.xz wireguard-openbsd-1cfdb13a9f2a09f2273db1b3a1d617646ef58ead.zip | |
Reset block ack state and cancel related timeouts when a HT node disassociates.
The existing code (from damien@) already took care of freeing related buffers
but because block ack state was not reset we were still trying to use these
buffers if the node sent another A-MPDU. This problem only affects 11n hostap.
Fixes kernel crash reported by Timo Myyra on bugs@
| -rw-r--r-- | sys/net80211/ieee80211_node.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/net80211/ieee80211_node.c b/sys/net80211/ieee80211_node.c index 1d5c75f6176..af318f1ee89 100644 --- a/sys/net80211/ieee80211_node.c +++ b/sys/net80211/ieee80211_node.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_node.c,v 1.111 2017/01/09 20:18:59 stsp Exp $ */ +/* $OpenBSD: ieee80211_node.c,v 1.112 2017/01/16 09:35:43 stsp Exp $ */ /* $NetBSD: ieee80211_node.c,v 1.14 2004/05/09 09:18:47 dyoung Exp $ */ /*- @@ -1638,6 +1638,7 @@ ieee80211_node_leave_ht(struct ieee80211com *ic, struct ieee80211_node *ni) int i; /* free all Block Ack records */ + ieee80211_ba_del(ni); for (tid = 0; tid < IEEE80211_NUM_TID; tid++) { ba = &ni->ni_rx_ba[tid]; if (ba->ba_buf != NULL) { |