diff options
| author | Avinash Patil <patila@marvell.com> | 2014-12-05 23:23:41 +0530 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2014-12-05 14:15:25 -0500 |
| commit | c11fb9857f8c7951e30509c5af72ada8e121be8b (patch) | |
| tree | 60cea5b4884ea221e936e1a29444678ffe508596 /drivers/net/wireless/mwifiex/uap_txrx.c | |
| parent | 9817fffbf04caae2843bc09321561afdea8c8d89 (diff) | |
mwifiex: guard station nodes access by station list lock
Station node entries should be guarded for whole of their reference
instead of just while getting node entry from station list.
It may happen that station node is retrieved may be deleted by
deauthentication event while it is still in use.
Reported by: Tim Shepard <shep@xplot.org>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/mwifiex/uap_txrx.c')
| -rw-r--r-- | drivers/net/wireless/mwifiex/uap_txrx.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c index e7d326f5b96e..be3a203a529b 100644 --- a/drivers/net/wireless/mwifiex/uap_txrx.c +++ b/drivers/net/wireless/mwifiex/uap_txrx.c @@ -266,6 +266,7 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv, struct rx_packet_hdr *rx_pkt_hdr; u16 rx_pkt_type; u8 ta[ETH_ALEN], pkt_type; + unsigned long flags; struct mwifiex_sta_node *node; uap_rx_pd = (struct uap_rxpd *)(skb->data); @@ -294,10 +295,12 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv, memcpy(ta, rx_pkt_hdr->eth803_hdr.h_source, ETH_ALEN); if (rx_pkt_type != PKT_TYPE_BAR && uap_rx_pd->priority < MAX_NUM_TID) { + spin_lock_irqsave(&priv->sta_list_spinlock, flags); node = mwifiex_get_sta_entry(priv, ta); if (node) node->rx_seq[uap_rx_pd->priority] = le16_to_cpu(uap_rx_pd->seq_num); + spin_unlock_irqrestore(&priv->sta_list_spinlock, flags); } if (!priv->ap_11n_enabled || |