diff options
| author | Michael Büsch <m@bues.ch> | 2015-01-26 20:26:17 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2015-01-29 11:28:05 +0300 |
| commit | a75d46a4f405eb19ff780410b968c8092af3fb1d (patch) | |
| tree | 0d8bbcae8f9d324ce1aa365a0a1333c9bb906142 /drivers/net/wireless/b43/b43.h | |
| parent | cf075eac9ca94ec54b5ae0c0ec798839f962be55 (diff) | |
| download | linux-a75d46a4f405eb19ff780410b968c8092af3fb1d.tar.xz | |
b43: Fix locking FIXME in beacon update top half
b43 has a FIXME about locking in the mac80211 set-beacon-int callback for a long time.
As it turns out there actually is a tiny race window that could result in
a use-after-free bug of the 'current_beacon' memory.
Nobody ever reported this, so it probably never happened.
Fix this by adding a spin lock that protects the current_beacon access.
We must not be in atomic context while accessing hardware (due to SDIO),
so the beacon update bottom half has to clone the skb and release the lock
before writing it to hardware.
Let's all hope that this stops the troll who is trying to submit incorrect
fixes for this issue repeatedly.
And let's hope that I'm not a troll, too, who just hides even more evil code
in an even more complex attempt to fix the issue.
Signed-off-by: Michael Buesch <m@bues.ch>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/b43/b43.h')
| -rw-r--r-- | drivers/net/wireless/b43/b43.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h index bb12586cd7cd..65b2dd80ecd5 100644 --- a/drivers/net/wireless/b43/b43.h +++ b/drivers/net/wireless/b43/b43.h @@ -941,6 +941,7 @@ struct b43_wl { bool beacon1_uploaded; bool beacon_templates_virgin; /* Never wrote the templates? */ struct work_struct beacon_update_trigger; + spinlock_t beacon_lock; /* The current QOS parameters for the 4 queues. */ struct b43_qos_params qos_params[B43_QOS_QUEUE_NUM]; |