summaryrefslogtreecommitdiff
path: root/net/mac80211/mesh_pathtbl.c
diff options
context:
space:
mode:
authorJavier Cardona <javier@cozybit.com>2011-08-29 13:23:03 -0700
committerJohn W. Linville <linville@tuxdriver.com>2011-09-13 15:42:32 -0400
commitaf089c15cb13e1c5d984e41f495c8363dd5b1e30 (patch)
tree284b907417b2e0adbc2be6294d4913709e29672f /net/mac80211/mesh_pathtbl.c
parent5982b47aa410e6aef55a5b0087269f5c9c172110 (diff)
mac80211: Fix RCU pointer dereference in mesh_path_discard_frame()
Reported by Pedro Larbig (ASPj) Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/mesh_pathtbl.c')
-rw-r--r--net/mac80211/mesh_pathtbl.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index ede4f5242e0b..2218eaf48bcb 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -991,9 +991,14 @@ void mesh_path_discard_frame(struct sk_buff *skb,
da = hdr->addr3;
ra = hdr->addr1;
+ rcu_read_lock();
mpath = mesh_path_lookup(da, sdata);
- if (mpath)
+ if (mpath) {
+ spin_lock_bh(&mpath->state_lock);
sn = ++mpath->sn;
+ spin_unlock_bh(&mpath->state_lock);
+ }
+ rcu_read_unlock();
mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data,
cpu_to_le32(sn), reason, ra, sdata);
}