Johannes Berg 788211d81b mac80211: fix RX A-MPDU session reorder timer deletion ... There's an issue with the way the RX A-MPDU reorder timer is deleted that can cause a kernel crash like this: * tid_rx is removed - call_rcu(ieee80211_free_tid_rx) * station is destroyed * reorder timer fires before ieee80211_free_tid_rx() runs, accessing the station, thus potentially crashing due to the use-after-free The station deletion is protected by synchronize_net(), but that isn't enough -- ieee80211_free_tid_rx() need not have run when that returns (it deletes the timer.) We could use rcu_barrier() instead of synchronize_net(), but that's much more expensive. Instead, to fix this, add a field tracking that the session is being deleted. In this case, the only re-arming of the timer happens with the reorder spinlock held, so make that code not rearm it if the session is being deleted and also delete the timer after setting that field. This ensures the timer cannot fire after ___ieee80211_stop_rx_ba_session() returns, which fixes the problem. Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2015-04-01 14:35:01 +02:00
..
aes_ccm.c
aes_ccm.h
aes_cmac.c
aes_cmac.h
aes_gcm.c
aes_gcm.h
aes_gmac.c
aes_gmac.h
agg-rx.c	mac80211: fix RX A-MPDU session reorder timer deletion	2015-04-01 14:35:01 +02:00
agg-tx.c
cfg.c
cfg.h
chan.c
debug.h
debugfs_key.c
debugfs_key.h
debugfs_netdev.c
debugfs_netdev.h
debugfs_sta.c
debugfs_sta.h
debugfs.c
debugfs.h
driver-ops.h
ethtool.c
event.c
ht.c
ibss.c
ieee80211_i.h	mac80211: ignore CSA to same channel	2015-03-16 09:36:12 +01:00
iface.c
Kconfig
key.c
key.h
led.c
led.h
main.c
Makefile
mesh_hwmp.c
mesh_pathtbl.c
mesh_plink.c
mesh_ps.c
mesh_sync.c
mesh.c
mesh.h
michael.c
michael.h
mlme.c	mac80211: ignore CSA to same channel	2015-03-16 09:36:12 +01:00
ocb.c
offchannel.c
pm.c
rate.c
rate.h
rc80211_minstrel_debugfs.c
rc80211_minstrel_ht_debugfs.c
rc80211_minstrel_ht.c
rc80211_minstrel_ht.h
rc80211_minstrel.c
rc80211_minstrel.h
rx.c	mac80211: fix RX A-MPDU session reorder timer deletion	2015-04-01 14:35:01 +02:00
scan.c
spectmgmt.c
sta_info.c
sta_info.h	mac80211: fix RX A-MPDU session reorder timer deletion	2015-04-01 14:35:01 +02:00
status.c
tdls.c
tkip.c
tkip.h
trace.c
trace.h
tx.c
util.c
vht.c
wep.c
wep.h
wme.c
wme.h
wpa.c
wpa.h