projects / wrapfs-4.14.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7444a79) | patch
mt76: clear skb pointers from rx aggregation reorder buffer during cleanup
authorFelix Fietkau <nbd@nbd.name>
Fri, 13 Dec 2019 23:15:26 +0000 (00:15 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 1 Oct 2020 11:14:33 +0000 (13:14 +0200)
commitac6724d49f654ecb722f84c33ebb8ece64958182
tree8d0320b87ff85068d86a4cf1504a1cb20a6059cbtree | snapshot
parent7444a79b60c777fb4c7bc2f4073c1ec95ee0cbf4commit | diff
mt76: clear skb pointers from rx aggregation reorder buffer during cleanup

[ Upstream commit 9379df2fd9234e3b67a23101c2370c99f6af6d77 ]

During the cleanup of the aggregation session, a rx handler (or release timer)
on another CPU might still hold a pointer to the reorder buffer and could
attempt to release some packets.
Clearing pointers during cleanup avoids a theoretical use-after-free bug here.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/mediatek/mt76/agg-rx.c diff | blob | history
wrapfs-4.14.y