diff options
author | John Crispin <john@phrozen.org> | 2018-08-02 08:44:29 +0200 |
---|---|---|
committer | John Crispin <john@phrozen.org> | 2018-09-26 16:35:33 +0200 |
commit | d9eefa7a7031543571d434693c7f984dfbdc990d (patch) | |
tree | 73ac027ccf6cdb6fd209a83e7e25c3d0472d46b4 /package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch | |
parent | e9d92bf1e1af71ff19e4cdc753de3f65963c58a5 (diff) | |
download | upstream-d9eefa7a7031543571d434693c7f984dfbdc990d.tar.gz upstream-d9eefa7a7031543571d434693c7f984dfbdc990d.tar.bz2 upstream-d9eefa7a7031543571d434693c7f984dfbdc990d.zip |
mac80211: rebase ontop of v4.18.5
Signed-off-by: John Crispin <john@phrozen.org>
Diffstat (limited to 'package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch')
-rw-r--r-- | package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch | 37 |
1 files changed, 0 insertions, 37 deletions
diff --git a/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch b/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch deleted file mode 100644 index ecc5e49120..0000000000 --- a/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch +++ /dev/null @@ -1,37 +0,0 @@ -From: Johannes Berg <johannes.berg@intel.com> -Date: Mon, 20 Nov 2017 17:01:44 +0100 -Subject: [PATCH] mac80211: properly free requested-but-not-started TX agg - sessions - -When deleting a station or otherwise tearing down all aggregation -sessions, make sure to delete requested but not yet started ones, -to avoid the following scenario: - - * session is requested, added to tid_start_tx[] - * ieee80211_ba_session_work() runs, gets past BLOCK_BA check - * ieee80211_sta_tear_down_BA_sessions() runs, locks &sta->ampdu_mlme.mtx, - e.g. while deleting the station - deleting all active sessions - * ieee80211_ba_session_work() continues since tear down flushes it, and - calls ieee80211_tx_ba_session_handle_start() for the new session, arms - the timer for it - * station deletion continues to __cleanup_single_sta() and frees the - session struct, while the timer is armed - -Reported-by: Fengguang Wu <fengguang.wu@intel.com> -Signed-off-by: Johannes Berg <johannes.berg@intel.com> ---- - ---- a/net/mac80211/agg-tx.c -+++ b/net/mac80211/agg-tx.c -@@ -330,6 +330,11 @@ int ___ieee80211_stop_tx_ba_session(stru - - spin_lock_bh(&sta->lock); - -+ /* free struct pending for start, if present */ -+ tid_tx = sta->ampdu_mlme.tid_start_tx[tid]; -+ kfree(tid_tx); -+ sta->ampdu_mlme.tid_start_tx[tid] = NULL; -+ - tid_tx = rcu_dereference_protected_tid_tx(sta, tid); - if (!tid_tx) { - spin_unlock_bh(&sta->lock); |