Commit 0a557ed3 authored by Eliad Peller's avatar Eliad Peller Committed by John W. Linville

mac80211: check sta_info_get() return value

ieee80211_stop_rx_ba_session() was calling sta_info_get()
without rcu locking, and the return value was not
checked.
This resulted in the following panic:

[<bf05726c>] (ieee80211_stop_rx_ba_session+0x0/0x60 [mac80211])
[<bf0abd94>] (wl1271_event_handle+0x0/0xdc8 [wl12xx])
[<bf0a7308>] (wl1271_irq+0x0/0x4a0 [wl12xx])
[<c00c40a8>] (irq_thread+0x0/0x254)
[<c00a7398>] (kthread+0x0/0x8c)
Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
Reviewed-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 5966f2dd
...@@ -104,14 +104,22 @@ void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap, ...@@ -104,14 +104,22 @@ void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
const u8 *addr) const u8 *addr)
{ {
struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
struct sta_info *sta = sta_info_get(sdata, addr); struct sta_info *sta;
int i; int i;
rcu_read_lock();
sta = sta_info_get(sdata, addr);
if (!sta) {
rcu_read_unlock();
return;
}
for (i = 0; i < STA_TID_NUM; i++) for (i = 0; i < STA_TID_NUM; i++)
if (ba_rx_bitmap & BIT(i)) if (ba_rx_bitmap & BIT(i))
set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested); set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested);
ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work); ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
rcu_read_unlock();
} }
EXPORT_SYMBOL(ieee80211_stop_rx_ba_session); EXPORT_SYMBOL(ieee80211_stop_rx_ba_session);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment