diff options
author | Felix Fietkau <nbd@openwrt.org> | 2010-07-02 16:11:18 +0000 |
---|---|---|
committer | Felix Fietkau <nbd@openwrt.org> | 2010-07-02 16:11:18 +0000 |
commit | 05764ce69c75e49fb0f13f50bf193e2a6c7a60ee (patch) | |
tree | a3d3e258c7c680a0e526526e8224e0daff22d7bc /package | |
parent | 6e0d17c89252ca4bdfb656ccde922c2e33a4f3fa (diff) | |
download | upstream-05764ce69c75e49fb0f13f50bf193e2a6c7a60ee.tar.gz upstream-05764ce69c75e49fb0f13f50bf193e2a6c7a60ee.tar.bz2 upstream-05764ce69c75e49fb0f13f50bf193e2a6c7a60ee.zip |
ath9k: fix a potential buffer leak
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22048 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package')
-rw-r--r-- | package/mac80211/patches/560-ath9k_buffer_leak.patch | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/package/mac80211/patches/560-ath9k_buffer_leak.patch b/package/mac80211/patches/560-ath9k_buffer_leak.patch new file mode 100644 index 0000000000..aa1f033fa3 --- /dev/null +++ b/package/mac80211/patches/560-ath9k_buffer_leak.patch @@ -0,0 +1,68 @@ +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2430,37 +2430,37 @@ void ath_tx_node_init(struct ath_softc * + + void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an) + { +- int i; +- struct ath_atx_ac *ac, *ac_tmp; +- struct ath_atx_tid *tid, *tid_tmp; ++ struct ath_atx_ac *ac; ++ struct ath_atx_tid *tid; + struct ath_txq *txq; ++ int i, tidno; + +- for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) { +- if (ATH_TXQ_SETUP(sc, i)) { +- txq = &sc->tx.txq[i]; +- +- spin_lock_bh(&txq->axq_lock); +- +- list_for_each_entry_safe(ac, +- ac_tmp, &txq->axq_acq, list) { +- tid = list_first_entry(&ac->tid_q, +- struct ath_atx_tid, list); +- if (tid && tid->an != an) +- continue; +- list_del(&ac->list); +- ac->sched = false; +- +- list_for_each_entry_safe(tid, +- tid_tmp, &ac->tid_q, list) { +- list_del(&tid->list); +- tid->sched = false; +- ath_tid_drain(sc, txq, tid); +- tid->state &= ~AGGR_ADDBA_COMPLETE; +- tid->state &= ~AGGR_CLEANUP; +- } +- } ++ for (tidno = 0, tid = &an->tid[tidno]; ++ tidno < WME_NUM_TID; tidno++, tid++) { ++ i = tid->ac->qnum; + +- spin_unlock_bh(&txq->axq_lock); ++ if (!ATH_TXQ_SETUP(sc, i)) ++ continue; ++ ++ txq = &sc->tx.txq[i]; ++ ac = tid->ac; ++ ++ spin_lock_bh(&txq->axq_lock); ++ ++ if (tid->sched) { ++ list_del(&tid->list); ++ tid->sched = false; + } ++ ++ if (ac->sched) { ++ list_del(&ac->list); ++ tid->ac->sched = false; ++ } ++ ++ ath_tid_drain(sc, txq, tid); ++ tid->state &= ~AGGR_ADDBA_COMPLETE; ++ tid->state &= ~AGGR_CLEANUP; ++ ++ spin_unlock_bh(&txq->axq_lock); + } + } |