diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2012-02-25 21:48:08 +0100 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-02-27 14:06:42 -0500 |
| commit | 54e4ffb2abb3c086637cbc75a2bfe55a8ce987c8 (patch) | |
| tree | 85ffa4a2295970bb5b1ea7601544fa03a2fc2f4b /net/mac80211/iface.c | |
| parent | fda82417884eecd9f2c8b4e6bb2039def0da7ec4 (diff) | |
| download | talos-op-linux-54e4ffb2abb3c086637cbc75a2bfe55a8ce987c8.tar.gz talos-op-linux-54e4ffb2abb3c086637cbc75a2bfe55a8ce987c8.zip | |
mac80211: fix auth/assoc data & timer leak
When removing an interface while it is in the
process of authenticating or associating, we
leak the auth_data or assoc_data, and leave
the timer pending. The timer then crashes the
system when it fires as its data is gone.
Fix this by explicitly deleting all the data
when the interface is removed. This uncovered
another bug -- this problem should have been
detected by the sta_info_flush() warning but
that function doesn't ever return non-zero,
I'll fix that in a separate patch.
Reported-by: Hieu Nguyen <hieux.c.nguyen@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/iface.c')
| -rw-r--r-- | net/mac80211/iface.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index 6b3cd65d1e07..60b240ce709e 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -644,6 +644,8 @@ static void ieee80211_teardown_sdata(struct net_device *dev) if (ieee80211_vif_is_mesh(&sdata->vif)) mesh_rmc_free(sdata); + else if (sdata->vif.type == NL80211_IFTYPE_STATION) + ieee80211_mgd_teardown(sdata); flushed = sta_info_flush(local, sdata); WARN_ON(flushed); |
