Skip to contentSkip to conversation

cfg80211: fix locking in action frame TX

PATCH New Johannes Berg 1 participant 1 message Aug 9, 2010 802.11 (including cfg80211/NL80211)

lore
Share & tools
lore

Johannes Berg

author maintainer
#0 lore raw

PATCH 1/1 cfg80211: fix locking in action frame TX

From: Johannes Berg <[email protected]>

Accesses to "wdev->current_bss" must be
locked with the wdev lock, which action
frame transmission is missing.

Cc [email protected] [2.6.33+]
Signed-off-by Johannes Berg <[email protected]>
---
 net/wireless/mlme.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
net/wireless/mlme.c +7 -1
@@ -844,13 +844,19 @@ int cfg80211_mlme_action(struct cfg80211
 		return -EINVAL;
 	if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 		/* Verify that we are associated with the destination AP */
+		wdev_lock(wdev);
+
 		if (!wdev->current_bss ||
 		    memcmp(wdev->current_bss->pub.bssid, mgmt->bssid,
 			   ETH_ALEN) != 0 ||
 		    (wdev->iftype == NL80211_IFTYPE_STATION &&
 		     memcmp(wdev->current_bss->pub.bssid, mgmt->da,
-			    ETH_ALEN) != 0))
+			    ETH_ALEN) != 0)) {
+			wdev_unlock(wdev);
 			return -ENOTCONN;
+		}
+
+		wdev_unlock(wdev);
 	}
 
 	if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)