| commit | 3fbd45ca8d1c98f3c2582ef8bc70ade42f70947b | |
| author | Johannes Berg <johannes.berg@intel.com> | |
| Mon, 25 Mar 2013 10:51:14 +0000 (25 11:51 +0100) | ||
| committer | Johannes Berg <johannes.berg@intel.com> | |
| Mon, 25 Mar 2013 12:50:33 +0000 (25 13:50 +0100) | ||
| tree | e19f4ad8aeda39090f26643c2063fc1050300391 | treesnapshot (tar.gz zip) |
| parent | 370bd005937c0e00f9104a602f9fe1dd6b21b54b | commitdiff |
mac80211: fix remain-on-channel cancel crash
If a ROC item is canceled just as it expires, the work
struct may be scheduled while it is running (and waiting
for the mutex). This results in it being run after being
freed, which obviously crashes.
To fix this don't free it when aborting is requested but
instead mark it as "to be freed", which makes the work a
no-op and allows freeing it outside.
Cc: stable@vger.kernel.org [3.6+]
Reported-by: Jouni Malinen <j@w1.fi>
Tested-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
If a ROC item is canceled just as it expires, the work
struct may be scheduled while it is running (and waiting
for the mutex). This results in it being run after being
freed, which obviously crashes.
To fix this don't free it when aborting is requested but
instead mark it as "to be freed", which makes the work a
no-op and allows freeing it outside.
Cc: stable@vger.kernel.org [3.6+]
Reported-by: Jouni Malinen <j@w1.fi>
Tested-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| net/mac80211/cfg.c | diffblobblamehistory | |
| net/mac80211/ieee80211_i.h | diffblobblamehistory | |
| net/mac80211/offchannel.c | diffblobblamehistory |