diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2012-11-29 01:25:20 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2012-11-30 13:42:20 +0100 |
| commit | 9caf03640279e64d0ba36539b42daa1b43a49486 (patch) | |
| tree | cb094a4a577f61421d1b402e16f0e68f151d5726 /net/wireless/core.h | |
| parent | mac80211: remove probe response temporary buffer allocation (diff) | |
| download | linux-9caf03640279e64d0ba36539b42daa1b43a49486.tar.xz linux-9caf03640279e64d0ba36539b42daa1b43a49486.zip | |
cfg80211: fix BSS struct IE access races
When a BSS struct is updated, the IEs are currently
overwritten or freed. This can lead to races if some
other CPU is accessing the BSS struct and using the
IEs concurrently.
Fix this by always allocating the IEs in a new struct
that holds the data and length and protecting access
to this new struct with RCU.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless/core.h')
| -rw-r--r-- | net/wireless/core.h | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/net/wireless/core.h b/net/wireless/core.h index 6183a0d25b8b..3563097169cb 100644 --- a/net/wireless/core.h +++ b/net/wireless/core.h @@ -138,8 +138,6 @@ struct cfg80211_internal_bss { unsigned long ts; struct kref ref; atomic_t hold; - bool beacon_ies_allocated; - bool proberesp_ies_allocated; /* must be last because of priv member */ struct cfg80211_bss pub; |