Files
linux/net
Stanislaw Gruszka eb221774b3 mac80211: fix possible tid_rx->reorder_timer use after free
commit d72308bff5 upstream.

Is possible that we will arm the tid_rx->reorder_timer after
del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop
timer after RCU grace period finish, so move it to
ieee80211_free_tid_rx(). Timer will not be armed again, as
rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL.

Debug object detected problem with the following warning:
ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211]

Bug report (with all warning messages):
https://bugzilla.redhat.com/show_bug.cgi?id=804007

Reported-by: "jan p. springer" <jsd@igroup.org>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-04-13 08:14:06 -07:00
..
2011-05-23 16:29:24 -04:00
2011-04-17 00:48:31 -07:00
2011-11-11 09:36:45 -08:00
2011-07-19 11:25:04 -07:00
2011-03-14 17:02:42 -07:00
2011-03-17 11:59:32 +11:00
2012-03-23 11:20:51 -07:00
2011-03-21 18:16:39 -07:00
2011-05-24 01:13:12 -04:00
2012-04-02 09:27:20 -07:00
2011-05-24 01:13:12 -04:00
2011-05-24 01:13:12 -04:00
2012-04-02 09:27:21 -07:00
2012-02-29 16:34:07 -08:00
2011-05-24 01:13:12 -04:00
2011-03-31 11:26:23 -03:00
2011-05-05 11:10:14 -07:00
2011-04-29 10:20:53 -07:00
2010-10-15 15:53:27 +02:00