]> git.karo-electronics.de Git - linux-beck.git/commitdiff
mwl8k: fix possible race condition in info->control.sta use
authorThomas Huehn <thomas@net.t-labs.tu-berlin.de>
Wed, 11 Jul 2012 11:21:41 +0000 (13:21 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 11 Jul 2012 20:24:55 +0000 (16:24 -0400)
info->control.sta may only be dereferenced during the drv_tx call otherwise
could lead to use-after-free bugs

Reported-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/mwl8k.c

index cf7bdc66f8225b6a850eafe5845e1fcb43474d80..224e03ade145cbbcfbd597095948c70d2a1e9beb 100644 (file)
@@ -1665,7 +1665,9 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
 
                info = IEEE80211_SKB_CB(skb);
                if (ieee80211_is_data(wh->frame_control)) {
-                       sta = info->control.sta;
+                       rcu_read_lock();
+                       sta = ieee80211_find_sta_by_ifaddr(hw, wh->addr1,
+                                                          wh->addr2);
                        if (sta) {
                                sta_info = MWL8K_STA(sta);
                                BUG_ON(sta_info == NULL);
@@ -1682,6 +1684,7 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
                                        sta_info->is_ampdu_allowed = true;
                                }
                        }
+                       rcu_read_unlock();
                }
 
                ieee80211_tx_info_clear_status(info);