Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af3e09e6 authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'mac80211-for-davem-2015-04-01' of... 

Merge tag 'mac80211-for-davem-2015-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211



Johannes Berg says:

====================
This contains just a single fix for a crash I happened to randomly
run into today during testing. It's clearly been around for a while,
but is pretty hard to trigger, even when I tried explicitly (and
modified the code to make it more likely) it rarely did.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 9c026424 788211d8

net/mac80211/agg-rx.c

+6 −2
Original line number Diff line number Diff line
@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h) 
		container_of(h, struct tid_ampdu_rx, rcu_head);

	int i;



	del_timer_sync(&tid_rx->reorder_timer);



	for (i = 0; i < tid_rx->buf_size; i++)

		__skb_queue_purge(&tid_rx->reorder_buf[i]);

	kfree(tid_rx->reorder_buf);
@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid, 


	del_timer_sync(&tid_rx->session_timer);



	/* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */

	spin_lock_bh(&tid_rx->reorder_lock);

	tid_rx->removed = true;

	spin_unlock_bh(&tid_rx->reorder_lock);

	del_timer_sync(&tid_rx->reorder_timer);



	call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);

}

net/mac80211/rx.c

+4 −3
Original line number Diff line number Diff line
@@ -873,6 +873,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 


 set_release_timer:



		if (!tid_agg_rx->removed)

			mod_timer(&tid_agg_rx->reorder_timer,

				  tid_agg_rx->reorder_time[j] + 1 +

				  HT_RX_REORDER_BUF_TIMEOUT);

net/mac80211/sta_info.h

+2 −0
Original line number Diff line number Diff line
@@ -175,6 +175,7 @@ struct tid_ampdu_tx { 
 * @reorder_lock: serializes access to reorder buffer, see below.

 * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and

 *	and ssn.

 * @removed: this session is removed (but might have been found due to RCU)

 *

 * This structure's lifetime is managed by RCU, assignments to

 * the array holding it must hold the aggregation mutex.
@@ -199,6 +200,7 @@ struct tid_ampdu_rx { 
	u16 timeout;

	u8 dialog_token;

	bool auto_seq;

	bool removed;

};



/**