diff options
Diffstat (limited to 'package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch')
-rw-r--r-- | package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch | 60 |
1 files changed, 0 insertions, 60 deletions
diff --git a/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch b/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch deleted file mode 100644 index 7dec1fb..0000000 --- a/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch +++ /dev/null @@ -1,60 +0,0 @@ -From: Ben Greear <greearb@candelatech.com> -Date: Fri, 1 Apr 2016 14:12:09 -0700 -Subject: [PATCH] ath10k: Ensure peer_map references are cleaned up. - -While debugging OS crashes due to firmware crashes, I enabled -kasan, and it noticed that peer objects were being used-after-freed. - -Looks like there are two places we could be leaving stale references -in the peer-map, so clean that up. - -Signed-off-by: Ben Greear <greearb@candelatech.com> ---- - ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -802,6 +802,7 @@ static void ath10k_peer_cleanup(struct a - { - struct ath10k_peer *peer, *tmp; - int peer_id; -+ int i; - - lockdep_assert_held(&ar->conf_mutex); - -@@ -818,6 +819,17 @@ static void ath10k_peer_cleanup(struct a - ar->peer_map[peer_id] = NULL; - } - -+ /* Double check that peer is properly un-referenced from -+ * the peer_map -+ */ -+ for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) { -+ if (ar->peer_map[i] == peer) { -+ ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %p idx %d)\n", -+ peer->addr, peer, i); -+ ar->peer_map[i] = NULL; -+ } -+ } -+ - list_del(&peer->list); - kfree(peer); - ar->num_peers--; -@@ -828,6 +840,7 @@ static void ath10k_peer_cleanup(struct a - static void ath10k_peer_cleanup_all(struct ath10k *ar) - { - struct ath10k_peer *peer, *tmp; -+ int i; - - lockdep_assert_held(&ar->conf_mutex); - -@@ -836,6 +849,10 @@ static void ath10k_peer_cleanup_all(stru - list_del(&peer->list); - kfree(peer); - } -+ -+ for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) -+ ar->peer_map[i] = NULL; -+ - spin_unlock_bh(&ar->data_lock); - - ar->num_peers = 0; |