aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2012-05-12 17:40:53 +0000
committerFelix Fietkau <nbd@openwrt.org>2012-05-12 17:40:53 +0000
commita8d08175a9aa0d4900c7b2b610d03930fee78705 (patch)
treef21e761c94f2af26b49846a11eeb0c36ef04478a
parentdb771744d5e8fa2f2c7da9b104ab9c9fecac8f2f (diff)
downloadmaster-187ad058-a8d08175a9aa0d4900c7b2b610d03930fee78705.tar.gz
master-187ad058-a8d08175a9aa0d4900c7b2b610d03930fee78705.tar.bz2
master-187ad058-a8d08175a9aa0d4900c7b2b610d03930fee78705.zip
ath9k: fix a rare use-after-free bug
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31690 3c298f89-4303-0410-b956-a3cf2f4a3e73
-rw-r--r--package/mac80211/patches/561-ath9k_fix_tid_buffer_free.patch67
1 files changed, 67 insertions, 0 deletions
diff --git a/package/mac80211/patches/561-ath9k_fix_tid_buffer_free.patch b/package/mac80211/patches/561-ath9k_fix_tid_buffer_free.patch
new file mode 100644
index 0000000000..fd0bfa9f17
--- /dev/null
+++ b/package/mac80211/patches/561-ath9k_fix_tid_buffer_free.patch
@@ -0,0 +1,67 @@
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -64,7 +64,8 @@ static void ath_tx_update_baw(struct ath
+ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
+ struct ath_txq *txq,
+ struct ath_atx_tid *tid,
+- struct sk_buff *skb);
++ struct sk_buff *skb,
++ bool dequeue);
+
+ enum {
+ MCS_HT20,
+@@ -821,7 +822,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_
+ fi = get_frame_info(skb);
+ bf = fi->bf;
+ if (!fi->bf)
+- bf = ath_tx_setup_buffer(sc, txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txq, tid, skb, true);
+
+ if (!bf)
+ continue;
+@@ -1737,7 +1738,7 @@ static void ath_tx_send_ampdu(struct ath
+ return;
+ }
+
+- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb, false);
+ if (!bf)
+ return;
+
+@@ -1766,7 +1767,7 @@ static void ath_tx_send_normal(struct at
+
+ bf = fi->bf;
+ if (!bf)
+- bf = ath_tx_setup_buffer(sc, txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txq, tid, skb, false);
+
+ if (!bf)
+ return;
+@@ -1827,7 +1828,8 @@ u8 ath_txchainmask_reduction(struct ath_
+ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
+ struct ath_txq *txq,
+ struct ath_atx_tid *tid,
+- struct sk_buff *skb)
++ struct sk_buff *skb,
++ bool dequeue)
+ {
+ struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ struct ath_frame_info *fi = get_frame_info(skb);
+@@ -1876,6 +1878,8 @@ static struct ath_buf *ath_tx_setup_buff
+ return bf;
+
+ error:
++ if (dequeue)
++ __skb_unlink(skb, &tid->buf_q);
+ dev_kfree_skb_any(skb);
+ return NULL;
+ }
+@@ -1895,7 +1899,7 @@ static void ath_tx_start_dma(struct ath_
+ */
+ ath_tx_send_ampdu(sc, tid, skb, txctl);
+ } else {
+- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb, false);
+ if (!bf)
+ return;
+