diff options
| author | Michal Kazior <michal.kazior@tieto.com> | 2014-04-09 17:29:32 +0400 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2014-04-25 19:08:30 +0400 |
| commit | 2b32713d72c093889fe20642f6a8bc42083267d2 (patch) | |
| tree | d5773d77a88b306fe4d8c48cc2173c1a49483dcb /block | |
| parent | 1f0d54cdcf822894cebebaa6cdc4e838c32bfb08 (diff) | |
| download | linux-2b32713d72c093889fe20642f6a8bc42083267d2.tar.xz | |
mac80211: fix racy usage of chanctx->refcount
Channel context refcount is protected by
chanctx_mtx. Accessing the value without holding
the mutex is racy. RCU section didn't guarantee
anything here.
Theoretically ieee80211_channel_switch() could
fail to see refcount change and read "1" instead
of, e.g. "2". This means mac80211 could accept CSA
even though it shouldn't have.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'block')
0 files changed, 0 insertions, 0 deletions