diff options
author | Johannes Berg <johannes@sipsolutions.net> | 2009-07-10 13:39:26 +0400 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2009-07-24 23:05:10 +0400 |
commit | a43816df2a1a61effcb701037bdf63621d066182 (patch) | |
tree | 33346bbbb1621dfc7966c2f4ad8b1a76f4145d18 /net/mac80211/mesh_hwmp.c | |
parent | ec3f149017ef3fd21343b1dcec3589eec6ba5dd5 (diff) | |
download | linux-a43816df2a1a61effcb701037bdf63621d066182.tar.xz |
mac80211: mesh: fix two small problems
1) there's a spin_lock() that needs to be spin_lock_bh()
2) action frames of size 24 might cause an out-of-bounds
memory access (for the 25th byte only, so no big deal)
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/mesh_hwmp.c')
-rw-r--r-- | net/mac80211/mesh_hwmp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c index f49ef288e2e2..8e86e910edfc 100644 --- a/net/mac80211/mesh_hwmp.c +++ b/net/mac80211/mesh_hwmp.c @@ -686,11 +686,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata) u8 ttl, dst_flags; u32 lifetime; - spin_lock(&ifmsh->mesh_preq_queue_lock); + spin_lock_bh(&ifmsh->mesh_preq_queue_lock); if (!ifmsh->preq_queue_len || time_before(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata))) { - spin_unlock(&ifmsh->mesh_preq_queue_lock); + spin_unlock_bh(&ifmsh->mesh_preq_queue_lock); return; } @@ -698,7 +698,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata) struct mesh_preq_queue, list); list_del(&preq_node->list); --ifmsh->preq_queue_len; - spin_unlock(&ifmsh->mesh_preq_queue_lock); + spin_unlock_bh(&ifmsh->mesh_preq_queue_lock); rcu_read_lock(); mpath = mesh_path_lookup(preq_node->dst, sdata); |