Skip to contentSkip to conversation

mac80211: Stop timer before deleting data structures.

RFC In review [email protected] 2 participants 4 messages Jun 18, 2013

Subsystems (2)
mac80211 802.11 (including cfg80211/NL80211)
lore
Share & tools
lore

[email protected]

author
#0 lore raw

RFC 1/2 mac80211: Stop timer before deleting data structures.

From: Ben Greear <[email protected]>

Not sure this matters, but it seems cleaner.

Signed-off-by Ben Greear <[email protected]>
---
 net/mac80211/mlme.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
net/mac80211/mlme.c +1 -1
index 732eda0..ebfa416 100644
@@ -4379,11 +4379,11 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
 	cancel_work_sync(&ifmgd->chswitch_work);
 
 	mutex_lock(&ifmgd->mtx);
+	del_timer_sync(&ifmgd->timer);
 	if (ifmgd->assoc_data)
 		ieee80211_destroy_assoc_data(sdata, false, true);
 	if (ifmgd->auth_data)
 		ieee80211_destroy_auth_data(sdata, false);
-	del_timer_sync(&ifmgd->timer);
 	mutex_unlock(&ifmgd->mtx);
 }
Signature · 1 line
1.7.3.4
author
#1 lore raw

RFC 2/2 wireless: Make sure __cfg80211_connect_result always puts bss.

From: Ben Greear <[email protected]>

Otherwise, we can leak a bss reference.

Signed-off-by Ben Greear <[email protected]>
---
 net/wireless/sme.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)
net/wireless/sme.c +9 -2
index 6066720..ea2ce33 100644
@@ -420,6 +420,7 @@ void cfg80211_sme_failed_assoc(struct wireless_dev *wdev)
 	schedule_work(&rdev->conn_work);
 }
 
+/** This method must consume bss one way or another */
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 			       const u8 *req_ie, size_t req_ie_len,
 			       const u8 *resp_ie, size_t resp_ie_len,

@@ -435,11 +436,17 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 	ASSERT_WDEV_LOCK(wdev);
 
 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
-		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
+		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) {
+		if (bss)
+			cfg80211_put_bss(wdev->wiphy, bss);
 		return;
+	}
 
-	if (wdev->sme_state != CFG80211_SME_CONNECTING)
+	if (wdev->sme_state != CFG80211_SME_CONNECTING) {
+		if (bss)
+			cfg80211_put_bss(wdev->wiphy, bss);
 		return;
+	}
 
 	nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
 				    bssid, req_ie, req_ie_len,
Signature · 1 line
1.7.3.4
maintainer
#2 lore raw

Re: [RFC 2/2] wireless: Make sure __cfg80211_connect_result always puts bss.

Quoted 22 lines · On Mon, 2013-06-17 at 17:28 -0700, [email protected] wrote:

From: Ben Greear <[email protected]>

Otherwise, we can leak a bss reference.

Signed-off-by Ben Greear <[email protected]>
---
 net/wireless/sme.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)
net/wireless/sme.c +1 -0
index 6066720..ea2ce33 100644
@@ -420,6 +420,7 @@ void cfg80211_sme_failed_assoc(struct wireless_dev *wdev)
 	schedule_work(&rdev->conn_work);
 }
 
+/** This method must consume bss one way or another */
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 			       const u8 *req_ie, size_t req_ie_len,
 			       const u8 *resp_ie, size_t resp_ie_len,

net/wireless/sme.c void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid, · line 443

Quoted 9 lines
net/wireless/sme.c +4 -1
@@ -435,11 +436,17 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 	ASSERT_WDEV_LOCK(wdev);
 
 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
-		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
+		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) {
+		if (bss)
+			cfg80211_put_bss(wdev->wiphy, bss);
 		return;
+	}

This is reasonable, though it'd be stupid to call it in this case, I'm not worried about leaking when the warning triggers.

net/wireless/sme.c void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid, · line 449

Quoted 6 lines
net/wireless/sme.c +4 -1
-	if (wdev->sme_state != CFG80211_SME_CONNECTING)
+	if (wdev->sme_state != CFG80211_SME_CONNECTING) {
+		if (bss)
+			cfg80211_put_bss(wdev->wiphy, bss);
 		return;
+	}

This code doesn't exist any more.

johannes