diff options
| author | Stanislaw Gruszka <[email protected]> | 2012-03-19 16:00:26 +0100 |
|---|---|---|
| committer | John W. Linville <[email protected]> | 2012-03-26 15:07:29 -0400 |
| commit | d72308bff5c2fa207949a5925b020bce74495e33 (patch) | |
| tree | 023e58d9a55d5439fcd1b0794b6bf095fa1115f4 /net/lapb/lapb_timer.c | |
| parent | 4e808a38fdcaeeeddbc05942623279ebe7c02373 (diff) | |
mac80211: fix possible tid_rx->reorder_timer use after free
Is possible that we will arm the tid_rx->reorder_timer after
del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop
timer after RCU grace period finish, so move it to
ieee80211_free_tid_rx(). Timer will not be armed again, as
rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL.
Debug object detected problem with the following warning:
ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211]
Bug report (with all warning messages):
https://bugzilla.redhat.com/show_bug.cgi?id=804007
Reported-by: "jan p. springer" <[email protected]>
Cc: [email protected]
Signed-off-by: Stanislaw Gruszka <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions