summaryrefslogtreecommitdiffstats
path: root/MAINTAINERS
diff options
context:
space:
mode:
authorStanislaw Gruszka <sgruszka@redhat.com>2012-03-19 16:00:26 +0100
committerJohn W. Linville <linville@tuxdriver.com>2012-03-26 21:07:29 +0200
commitd72308bff5c2fa207949a5925b020bce74495e33 (patch)
tree023e58d9a55d5439fcd1b0794b6bf095fa1115f4 /MAINTAINERS
parentrt2x00: rt2800usb: fix status register reread logic (diff)
downloadlinux-d72308bff5c2fa207949a5925b020bce74495e33.tar.xz
linux-d72308bff5c2fa207949a5925b020bce74495e33.zip
mac80211: fix possible tid_rx->reorder_timer use after free
Is possible that we will arm the tid_rx->reorder_timer after del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop timer after RCU grace period finish, so move it to ieee80211_free_tid_rx(). Timer will not be armed again, as rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL. Debug object detected problem with the following warning: ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211] Bug report (with all warning messages): https://bugzilla.redhat.com/show_bug.cgi?id=804007 Reported-by: "jan p. springer" <jsd@igroup.org> Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'MAINTAINERS')
0 files changed, 0 insertions, 0 deletions