Commit ccb6c136 authored Jul 13, 2010 by Johannes Berg Committed by John W. Linville Jul 14, 2010

cfg80211: don't get expired BSSes

When kernel-internal users use cfg80211_get_bss()
to get a reference to a BSS struct, they may end
up getting one that would have been removed from
the list if there had been any userspace access
to the list. This leads to inconsistencies and
problems.

Fix it by making cfg80211_get_bss() ignore BSSes
that cfg80211_bss_expire() would remove.

Fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2180



Cc: stable@kernel.org
Reported-by: Jiajia Zheng <jiajia.zheng@intel.com>
Tested-by: Jiajia Zheng <jiajia.zheng@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent 31e79a59

net/wireless/scan.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -275,6 +275,7 @@ struct cfg80211_bss cfg80211_get_bss(struct wiphy wiphy,
		{
		struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
		struct cfg80211_internal_bss bss, res = NULL;
		unsigned long now = jiffies;

		spin_lock_bh(&dev->bss_lock);

		@@ -283,6 +284,10 @@ struct cfg80211_bss cfg80211_get_bss(struct wiphy wiphy,
		continue;
		if (channel && bss->pub.channel != channel)
		continue;
		/* Don't get expired BSS structs */
		if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
		!atomic_read(&bss->hold))
		continue;
		if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
		res = bss;
		kref_get(&res->ref);