mac80211 sta_info->dev race

mac80211 sta_info->dev race

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 636 bytes --]

Hey,

I'm working on making sta_info a per-virtual-interface structure for the
rare case where we have multiple virtual stations associated to the same
AP or for example WDS links.

Working through the code I notice that struct sta_info has a "dev"
pointer (which I will change to "sdata"), but as far as I can tell
nothing guarantees that we don't do sta_info_get(), then down the
interface, and then try to dereference sta_info->dev.

I see two ways to avoid this:
 (1) in sta_info_flush(), wait until each sta is actually released,
     don't just put it
 (2) with each sta_info_get() also do a dev_hold()

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 190 bytes --]