This is a note to let you know that I've just added the patch titled

    mac80211: fix a few RCU issues

to the 2.6.39-stable tree which can be found at:
    
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mac80211-fix-a-few-rcu-issues.patch
and it can be found in the queue-2.6.39 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.


>From a3836e02ba4c50db958d32d710b226f2408623dc Mon Sep 17 00:00:00 2001
From: Johannes Berg <[email protected]>
Date: Thu, 12 May 2011 15:11:37 +0200
Subject: mac80211: fix a few RCU issues

From: Johannes Berg <[email protected]>

commit a3836e02ba4c50db958d32d710b226f2408623dc upstream.

A few configuration functions correctly do
rcu_read_lock() but don't correctly reference
some pointers protected by RCU. Fix that.

Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/cfg.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -228,11 +228,11 @@ static int ieee80211_get_key(struct wiph
                        goto out;
 
                if (pairwise)
-                       key = sta->ptk;
+                       key = rcu_dereference(sta->ptk);
                else if (key_idx < NUM_DEFAULT_KEYS)
-                       key = sta->gtk[key_idx];
+                       key = rcu_dereference(sta->gtk[key_idx]);
        } else
-               key = sdata->keys[key_idx];
+               key = rcu_dereference(sdata->keys[key_idx]);
 
        if (!key)
                goto out;
@@ -921,8 +921,10 @@ static int ieee80211_change_mpath(struct
 static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                            struct mpath_info *pinfo)
 {
-       if (mpath->next_hop)
-               memcpy(next_hop, mpath->next_hop->sta.addr, ETH_ALEN);
+       struct sta_info *next_hop_sta = rcu_dereference(mpath->next_hop);
+
+       if (next_hop_sta)
+               memcpy(next_hop, next_hop_sta->sta.addr, ETH_ALEN);
        else
                memset(next_hop, 0, ETH_ALEN);
 


Patches currently in stable-queue which might be from [email protected] 
are

_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable

Reply via email to