Commit af089c15 authored by Javier Cardona's avatar Javier Cardona Committed by John W. Linville

mac80211: Fix RCU pointer dereference in mesh_path_discard_frame()

Reported by Pedro Larbig (ASPj)
Signed-off-by: default avatarJavier Cardona <javier@cozybit.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 5982b47a
......@@ -991,9 +991,14 @@ void mesh_path_discard_frame(struct sk_buff *skb,
da = hdr->addr3;
ra = hdr->addr1;
rcu_read_lock();
mpath = mesh_path_lookup(da, sdata);
if (mpath)
if (mpath) {
spin_lock_bh(&mpath->state_lock);
sn = ++mpath->sn;
spin_unlock_bh(&mpath->state_lock);
}
rcu_read_unlock();
mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data,
cpu_to_le32(sn), reason, ra, sdata);
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment