diff options
| author | Javier Cardona <javier@cozybit.com> | 2011-08-30 00:23:03 +0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-09-13 23:42:32 +0400 |
| commit | af089c15cb13e1c5d984e41f495c8363dd5b1e30 (patch) | |
| tree | 284b907417b2e0adbc2be6294d4913709e29672f /net | |
| parent | 5982b47aa410e6aef55a5b0087269f5c9c172110 (diff) | |
| download | linux-af089c15cb13e1c5d984e41f495c8363dd5b1e30.tar.xz | |
mac80211: Fix RCU pointer dereference in mesh_path_discard_frame()
Reported by Pedro Larbig (ASPj)
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/mesh_pathtbl.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c index ede4f5242e0b..2218eaf48bcb 100644 --- a/net/mac80211/mesh_pathtbl.c +++ b/net/mac80211/mesh_pathtbl.c @@ -991,9 +991,14 @@ void mesh_path_discard_frame(struct sk_buff *skb, da = hdr->addr3; ra = hdr->addr1; + rcu_read_lock(); mpath = mesh_path_lookup(da, sdata); - if (mpath) + if (mpath) { + spin_lock_bh(&mpath->state_lock); sn = ++mpath->sn; + spin_unlock_bh(&mpath->state_lock); + } + rcu_read_unlock(); mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data, cpu_to_le32(sn), reason, ra, sdata); } |