[lkml]   [2012]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[ 29/78] mac80211: fix possible tid_rx->reorder_timer use after free
3.3-stable review patch.  If anyone has any objections, please let me know.


From: Stanislaw Gruszka <>

commit d72308bff5c2fa207949a5925b020bce74495e33 upstream.

Is possible that we will arm the tid_rx->reorder_timer after
del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop
timer after RCU grace period finish, so move it to
ieee80211_free_tid_rx(). Timer will not be armed again, as
rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL.

Debug object detected problem with the following warning:
ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211]

Bug report (with all warning messages):

Reported-by: "jan p. springer" <>
Signed-off-by: Stanislaw Gruszka <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>

net/mac80211/agg-rx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -49,6 +49,8 @@ static void ieee80211_free_tid_rx(struct
container_of(h, struct tid_ampdu_rx, rcu_head);
int i;

+ del_timer_sync(&tid_rx->reorder_timer);
for (i = 0; i < tid_rx->buf_size; i++)
@@ -91,7 +93,6 @@ void ___ieee80211_stop_rx_ba_session(str
tid, WLAN_BACK_RECIPIENT, reason);

- del_timer_sync(&tid_rx->reorder_timer);

call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);

 \ /
  Last update: 2012-04-12 02:05    [W:0.296 / U:2.532 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site