mac80211: Fix RCU pointer dereference in mesh_path_discard_frame()
Reported by Pedro Larbig (ASPj) Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
5982b47aa4
commit
af089c15cb
|
@ -991,9 +991,14 @@ void mesh_path_discard_frame(struct sk_buff *skb,
|
||||||
|
|
||||||
da = hdr->addr3;
|
da = hdr->addr3;
|
||||||
ra = hdr->addr1;
|
ra = hdr->addr1;
|
||||||
|
rcu_read_lock();
|
||||||
mpath = mesh_path_lookup(da, sdata);
|
mpath = mesh_path_lookup(da, sdata);
|
||||||
if (mpath)
|
if (mpath) {
|
||||||
|
spin_lock_bh(&mpath->state_lock);
|
||||||
sn = ++mpath->sn;
|
sn = ++mpath->sn;
|
||||||
|
spin_unlock_bh(&mpath->state_lock);
|
||||||
|
}
|
||||||
|
rcu_read_unlock();
|
||||||
mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data,
|
mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data,
|
||||||
cpu_to_le32(sn), reason, ra, sdata);
|
cpu_to_le32(sn), reason, ra, sdata);
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue