Hi Greg, This .36 patch from your queue looks like a mismerge to me. Note the line it adds is duplicated. It should be harmless, but is not needed for .36. drop it?
I think it's needed for .35 and I'll add it there. -Andi mac80211-delete-addba-response-timer.patch >From 44271488b91c9eecf249e075a1805dd887e222d2 Mon Sep 17 00:00:00 2001 From: Johannes Berg <[email protected]> Date: Tue, 5 Oct 2010 21:40:33 +0200 Subject: mac80211: delete AddBA response timer From: Johannes Berg <[email protected]> commit 44271488b91c9eecf249e075a1805dd887e222d2 upstream. We never delete the addBA response timer, which is typically fine, but if the station it belongs to is deleted very quickly after starting the BA session, before the peer had a chance to reply, the timer may fire after the station struct has been freed already. Therefore, we need to delete the timer in a suitable spot -- best when the session is being stopped (which will happen even then) in which case the delete will be a no-op most of the time. I've reproduced the scenario and tested the fix. This fixes the crash reported at http://mid.gmane.org/[email protected] Reported-by: Ben Greear <[email protected]> Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: John W. Linville <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> --- net/mac80211/agg-tx.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/mac80211/agg-tx.c +++ b/net/mac80211/agg-tx.c @@ -177,6 +177,8 @@ int ___ieee80211_stop_tx_ba_session(stru del_timer_sync(&tid_tx->addba_resp_timer); + del_timer_sync(&tid_tx->addba_resp_timer); + /* * After this packets are no longer handed right through * to the driver but are put onto tid_tx->pending instead, -- [email protected] -- Speaking for myself only. _______________________________________________ stable mailing list [email protected] http://linux.kernel.org/mailman/listinfo/stable
