lkml.org 
[lkml]   [2010]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[20/38] ath9k: fix a buffer leak in A-MPDU completion
    2.6.35-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Felix Fietkau <nbd@openwrt.org>

    commit 73e194639d90594d06d0c10019c0ab4638869135 upstream.

    When ath_tx_complete_aggr() is called, it's responsible for returning
    all buffers in the linked list. This was not done when the STA lookup
    failed, leading to a race condition that could leak a few buffers when
    a STA just disconnected.
    Fix this by immediately returning all buffers to the free list in this case.

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/net/wireless/ath/ath9k/xmit.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/drivers/net/wireless/ath/ath9k/xmit.c
    +++ b/drivers/net/wireless/ath/ath9k/xmit.c
    @@ -329,6 +329,7 @@ static void ath_tx_complete_aggr(struct
    int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
    bool rc_update = true;
    struct ieee80211_tx_rate rates[4];
    + unsigned long flags;

    skb = bf->bf_mpdu;
    hdr = (struct ieee80211_hdr *)skb->data;
    @@ -344,6 +345,10 @@ static void ath_tx_complete_aggr(struct
    sta = ieee80211_find_sta_by_hw(hw, hdr->addr1);
    if (!sta) {
    rcu_read_unlock();
    +
    + spin_lock_irqsave(&sc->tx.txbuflock, flags);
    + list_splice_tail_init(bf_q, &sc->tx.txbuf);
    + spin_unlock_irqrestore(&sc->tx.txbuflock, flags);
    return;
    }




    \
     
     \ /
      Last update: 2010-08-06 20:43    [W:0.032 / U:0.100 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site