AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-03 16:56:45 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

mwl8k: fix possible race condition in info->control.sta use

Browse Source 
info->control.sta may only be dereferenced during the drv_tx call otherwise
could lead to use-after-free bugs

Reported-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Thomas Huehn 2012-07-11 13:21:41 +02:00 committed by John W. Linville
parent 7c41f3159c
commit 89e1180121
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/mwl8k.c
View File

@ -1665,7 +1665,9 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
info = IEEE80211_SKB_CB(skb);
if (ieee80211_is_data(wh->frame_control)) {
sta = info->control.sta;
rcu_read_lock();
sta = ieee80211_find_sta_by_ifaddr(hw, wh->addr1,
wh->addr2);
if (sta) {
sta_info = MWL8K_STA(sta);
BUG_ON(sta_info == NULL);
@ -1682,6 +1684,7 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
sta_info->is_ampdu_allowed = true;
}
}
rcu_read_unlock();
}
ieee80211_tx_info_clear_status(info);