diff options
Diffstat (limited to 'package/madwifi/patches/111-wds_fix_PR_914.patch')
| -rw-r--r-- | package/madwifi/patches/111-wds_fix_PR_914.patch | 32 |
1 files changed, 10 insertions, 22 deletions
diff --git a/package/madwifi/patches/111-wds_fix_PR_914.patch b/package/madwifi/patches/111-wds_fix_PR_914.patch index 3f8607d..282b385 100644 --- a/package/madwifi/patches/111-wds_fix_PR_914.patch +++ b/package/madwifi/patches/111-wds_fix_PR_914.patch @@ -1,43 +1,31 @@ -WDS related crash is observed. This causes by possible random memory -writes/accesss. Note how wds is freed, yet it will be used further in -loop ... - -Other usages in the tree of LIST_FOREACH() when element is found and -acted up on element, loop is immediately break (either via break, or -return). But not in this case ... - -Signed-off-by: Mindaugas Kriaučiūnas <mindaugas.kriauciunas@gmail.com> -Signed-off-by: Žilvinas Valinskas <valins@soften.ktu.lt> - -Index: madwifi-ng-trunk/net80211/ieee80211_node.c -=================================================================== ---- madwifi-ng-trunk.orig/net80211/ieee80211_node.c 2006-09-25 13:28:08.000000000 +0300 -+++ madwifi-ng-trunk/net80211/ieee80211_node.c 2006-10-18 15:59:40.000000000 +0300 -@@ -961,11 +961,11 @@ +diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c +--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c 2007-05-04 23:09:29.000000000 +0200 ++++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c 2007-05-13 18:17:55.697101792 +0200 +@@ -981,11 +981,11 @@ ieee80211_del_wds_node(struct ieee80211_node_table *nt, struct ieee80211_node *ni) { int hash; - struct ieee80211_wds_addr *wds; + struct ieee80211_wds_addr *wds, *next; - IEEE80211_NODE_LOCK_IRQ(nt); + IEEE80211_NODE_TABLE_LOCK_IRQ(nt); for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) { - LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) { + LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, next) { if (wds->wds_ni == ni) { - if (ieee80211_node_dectestref(ni)) { - _ieee80211_free_node(ni); -@@ -984,11 +984,11 @@ + LIST_REMOVE(wds, wds_hash); + ieee80211_unref_node(&wds->wds_ni); +@@ -1002,11 +1002,11 @@ { struct ieee80211_node_table *nt = (struct ieee80211_node_table *)data; int hash; - struct ieee80211_wds_addr *wds; + struct ieee80211_wds_addr *wds, *next; - IEEE80211_NODE_LOCK_IRQ(nt); + IEEE80211_NODE_TABLE_LOCK_IRQ(nt); for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) { - LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) { + LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, next) { if (wds->wds_agingcount != WDS_AGING_STATIC) { if (!wds->wds_agingcount) { - if (ieee80211_node_dectestref(wds->wds_ni)) { + LIST_REMOVE(wds, wds_hash); |