mac80211: fix rcu-unsafe pointer dereference

PATCH New Christian Lamparter 1 participant 1 message Aug 24, 2010 mac80211

Share & tools

Christian Lamparter

author

2010-08-24 17:22 UTC #0 lore raw

PATCH 1/1 mac80211: fix rcu-unsafe pointer dereference

This patch fixes a potential crash (null-pointer de- reference) which was introduced in my previous patch:
"mac80211: AMPDU rx reorder timeout timer"

During a BA teardown, the pointer to the soon-to-be-gone tid_ampdu_rx element will be nullified. Therefore the release timer mechanism has to be careful not to accidentally access the item without any RCU protection.

Signed-off-by Christian Lamparter <[email protected]>

---

net/mac80211/rx.c +8 -4

index 06ef5c1..0c19702 100644
@@ -2482,6 +2482,11 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
 {
 	struct sk_buff_head frames;
 	struct ieee80211_rx_data rx = { };
+	struct tid_ampdu_rx *tid_agg_rx;
+
+	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
+	if (!tid_agg_rx)
+		return;
 
 	__skb_queue_head_init(&frames);

@@ -2496,10 +2501,9 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
 		     test_bit(SCAN_OFF_CHANNEL, &sta->local->scanning)))
 		rx.flags |= IEEE80211_RX_IN_SCAN;
 
-	spin_lock(&sta->ampdu_mlme.tid_rx[tid]->reorder_lock);
-	ieee80211_sta_reorder_release(&sta->local->hw,
-		sta->ampdu_mlme.tid_rx[tid], &frames);
-	spin_unlock(&sta->ampdu_mlme.tid_rx[tid]->reorder_lock);
+	spin_lock(&tid_agg_rx->reorder_lock);
+	ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx, &frames);
+	spin_unlock(&tid_agg_rx->reorder_lock);
 
 	ieee80211_rx_handlers(&rx, &frames);
 }