lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mac80211: fix ieee80211_get_buffered_bc

Browse Source 
fix bss not initialized in ieee80211_get_buffered_bc
and unbalanced locking

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Tomas Winkler
2008-05-27 17:50:51 +03:00
committed by John W. Linville
parent 20ad4fd562
commit 747cf5e924
1 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
net/mac80211/tx.c
View File

@@ -1947,7 +1947,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
struct ieee80211_vif *vif) struct ieee80211_vif *vif)
{ {
struct ieee80211_local *local = hw_to_local(hw); struct ieee80211_local *local = hw_to_local(hw);
struct sk_buff *skb; struct sk_buff *skb = NULL;
struct sta_info *sta; struct sta_info *sta;
ieee80211_tx_handler *handler; ieee80211_tx_handler *handler;
struct ieee80211_tx_data tx; struct ieee80211_tx_data tx;
@@ -1960,7 +1960,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
sdata = vif_to_sdata(vif); sdata = vif_to_sdata(vif);
bdev = sdata->dev; bdev = sdata->dev;
bss = &sdata->u.ap;
if (!bss) if (!bss)
return NULL; return NULL;
@@ -1968,19 +1968,16 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
rcu_read_lock(); rcu_read_lock();
beacon = rcu_dereference(bss->beacon); beacon = rcu_dereference(bss->beacon);
if (sdata->vif.type != IEEE80211_IF_TYPE_AP || !beacon || if (sdata->vif.type != IEEE80211_IF_TYPE_AP || !beacon || !beacon->head)
!beacon->head) { goto out;
rcu_read_unlock();
return NULL;
}
if (bss->dtim_count != 0) if (bss->dtim_count != 0)
return NULL; /* send buffered bc/mc only after DTIM beacon */ goto out; /* send buffered bc/mc only after DTIM beacon */
while (1) { while (1) {
skb = skb_dequeue(&bss->ps_bc_buf); skb = skb_dequeue(&bss->ps_bc_buf);
if (!skb) if (!skb)
return NULL; goto out;
local->total_ps_buffered--; local->total_ps_buffered--;
if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) { if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) {
@@ -2023,6 +2020,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
skb = NULL; skb = NULL;
} }
out:
rcu_read_unlock(); rcu_read_unlock();
return skb; return skb;