From: Javier Cardona <javier@cozybit.com>
To: "John W. Linville" <linville@tuxdriver.com>
Cc: Javier Cardona <javier@cozybit.com>,
Thomas Pedersen <thomas@cozybit.com>,
devel@lists.open80211s.org,
Johannes Berg <johannes@sipsolutions.net>,
linux-wireless@vger.kernel.org, jlopex@gmail.com
Subject: [PATCH v3 1/7] mac80211: Fix RCU pointer dereference in mesh_path_discard_frame()
Date: Mon, 29 Aug 2011 13:23:03 -0700 [thread overview]
Message-ID: <1314649389-7115-2-git-send-email-javier@cozybit.com> (raw)
In-Reply-To: <1314649389-7115-1-git-send-email-javier@cozybit.com>
Reported by Pedro Larbig (ASPj)
Signed-off-by: Javier Cardona <javier@cozybit.com>
---
v2: - Extend the rcu_read_lock section to protect mpath (Johannes)
- Take state lock when increasing mpath serial number (Johannes)
net/mac80211/mesh_pathtbl.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 3c2bcb2..c92fd70 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -991,9 +991,14 @@ void mesh_path_discard_frame(struct sk_buff *skb,
da = hdr->addr3;
ra = hdr->addr1;
+ rcu_read_lock();
mpath = mesh_path_lookup(da, sdata);
- if (mpath)
+ if (mpath) {
+ spin_lock_bh(&mpath->state_lock);
sn = ++mpath->sn;
+ spin_unlock_bh(&mpath->state_lock);
+ }
+ rcu_read_unlock();
mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data,
cpu_to_le32(sn), reason, ra, sdata);
}
--
1.7.6
next prev parent reply other threads:[~2011-08-29 20:23 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-29 20:23 [PATCH v3 0/7] mesh_fixes Javier Cardona
2011-08-29 20:23 ` Javier Cardona [this message]
2011-08-29 20:23 ` [PATCH v3 2/7] mac80211: Remove mesh paths when an interface is removed Javier Cardona
2011-08-30 3:19 ` Johannes Berg
2011-08-30 3:25 ` Johannes Berg
2011-08-29 20:23 ` [PATCH v3 3/7] mac80211: Improve mpath state locking Javier Cardona
2011-08-29 20:23 ` [PATCH v3 4/7] mac80211: Remove redundant mesh path expiration checks Javier Cardona
2011-08-29 20:23 ` [PATCH v3 5/7] mac80211: Don't iterate twice over all mpaths when once in sufficient Javier Cardona
2011-08-29 20:23 ` [PATCH v3 6/7] mac80211: Consolidate {mesh,mpp}_path_flush into one function Javier Cardona
2011-08-29 20:23 ` [PATCH v3 7/7] mac80211: Consolidate mesh path duplicated functions Javier Cardona
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1314649389-7115-2-git-send-email-javier@cozybit.com \
--to=javier@cozybit.com \
--cc=devel@lists.open80211s.org \
--cc=jlopex@gmail.com \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=thomas@cozybit.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).