aboutsummaryrefslogtreecommitdiffstats
path: root/package/mac80211
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2010-07-02 16:11:18 +0000
committerFelix Fietkau <nbd@openwrt.org>2010-07-02 16:11:18 +0000
commit05764ce69c75e49fb0f13f50bf193e2a6c7a60ee (patch)
treea3d3e258c7c680a0e526526e8224e0daff22d7bc /package/mac80211
parent6e0d17c89252ca4bdfb656ccde922c2e33a4f3fa (diff)
downloadmaster-187ad058-05764ce69c75e49fb0f13f50bf193e2a6c7a60ee.tar.gz
master-187ad058-05764ce69c75e49fb0f13f50bf193e2a6c7a60ee.tar.bz2
master-187ad058-05764ce69c75e49fb0f13f50bf193e2a6c7a60ee.zip
ath9k: fix a potential buffer leak
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22048 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/mac80211')
-rw-r--r--package/mac80211/patches/560-ath9k_buffer_leak.patch68
1 files changed, 68 insertions, 0 deletions
diff --git a/package/mac80211/patches/560-ath9k_buffer_leak.patch b/package/mac80211/patches/560-ath9k_buffer_leak.patch
new file mode 100644
index 0000000000..aa1f033fa3
--- /dev/null
+++ b/package/mac80211/patches/560-ath9k_buffer_leak.patch
@@ -0,0 +1,68 @@
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2430,37 +2430,37 @@ void ath_tx_node_init(struct ath_softc *
+
+ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
+ {
+- int i;
+- struct ath_atx_ac *ac, *ac_tmp;
+- struct ath_atx_tid *tid, *tid_tmp;
++ struct ath_atx_ac *ac;
++ struct ath_atx_tid *tid;
+ struct ath_txq *txq;
++ int i, tidno;
+
+- for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+- if (ATH_TXQ_SETUP(sc, i)) {
+- txq = &sc->tx.txq[i];
+-
+- spin_lock_bh(&txq->axq_lock);
+-
+- list_for_each_entry_safe(ac,
+- ac_tmp, &txq->axq_acq, list) {
+- tid = list_first_entry(&ac->tid_q,
+- struct ath_atx_tid, list);
+- if (tid && tid->an != an)
+- continue;
+- list_del(&ac->list);
+- ac->sched = false;
+-
+- list_for_each_entry_safe(tid,
+- tid_tmp, &ac->tid_q, list) {
+- list_del(&tid->list);
+- tid->sched = false;
+- ath_tid_drain(sc, txq, tid);
+- tid->state &= ~AGGR_ADDBA_COMPLETE;
+- tid->state &= ~AGGR_CLEANUP;
+- }
+- }
++ for (tidno = 0, tid = &an->tid[tidno];
++ tidno < WME_NUM_TID; tidno++, tid++) {
++ i = tid->ac->qnum;
+
+- spin_unlock_bh(&txq->axq_lock);
++ if (!ATH_TXQ_SETUP(sc, i))
++ continue;
++
++ txq = &sc->tx.txq[i];
++ ac = tid->ac;
++
++ spin_lock_bh(&txq->axq_lock);
++
++ if (tid->sched) {
++ list_del(&tid->list);
++ tid->sched = false;
+ }
++
++ if (ac->sched) {
++ list_del(&ac->list);
++ tid->ac->sched = false;
++ }
++
++ ath_tid_drain(sc, txq, tid);
++ tid->state &= ~AGGR_ADDBA_COMPLETE;
++ tid->state &= ~AGGR_CLEANUP;
++
++ spin_unlock_bh(&txq->axq_lock);
+ }
+ }