lkml.org 
[lkml]   [2012]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 15/42] mac80211: fix possible tid_rx->reorder_timer use after free
    3.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Stanislaw Gruszka <sgruszka@redhat.com>

    commit d72308bff5c2fa207949a5925b020bce74495e33 upstream.

    Is possible that we will arm the tid_rx->reorder_timer after
    del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop
    timer after RCU grace period finish, so move it to
    ieee80211_free_tid_rx(). Timer will not be armed again, as
    rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL.

    Debug object detected problem with the following warning:
    ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211]

    Bug report (with all warning messages):
    https://bugzilla.redhat.com/show_bug.cgi?id=804007

    Reported-by: "jan p. springer" <jsd@igroup.org>
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/mac80211/agg-rx.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/net/mac80211/agg-rx.c
    +++ b/net/mac80211/agg-rx.c
    @@ -48,6 +48,8 @@ static void ieee80211_free_tid_rx(struct
    container_of(h, struct tid_ampdu_rx, rcu_head);
    int i;

    + del_timer_sync(&tid_rx->reorder_timer);
    +
    for (i = 0; i < tid_rx->buf_size; i++)
    dev_kfree_skb(tid_rx->reorder_buf[i]);
    kfree(tid_rx->reorder_buf);
    @@ -87,7 +89,6 @@ void ___ieee80211_stop_rx_ba_session(str
    tid, 0, reason);

    del_timer_sync(&tid_rx->session_timer);
    - del_timer_sync(&tid_rx->reorder_timer);

    call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
    }



    \
     
     \ /
      Last update: 2012-04-12 01:31    [W:0.025 / U:29.664 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site