evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mac80211: Move num_sta_ps counter decrement after synchronize_rcu

Browse source 
Unted the assumption that the sta struct is still accessible before the
synchronize_rcu call we should move the num_sta_ps counter decrement
after synchronize_rcu to avoid incorrect decrements if num_sta_ps.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Helmut Schaa 2012-01-27 11:02:53 +01:00 • committed by John W. Linville
parent 19468413e8
commit 4f3eb0ba48
1 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
net/mac80211/sta_info.c
View file

@ -750,15 +750,6 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
sta->dead = true; sta->dead = true;
if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
BUG_ON(!sdata->bss);
clear_sta_flag(sta, WLAN_STA_PS_STA);
atomic_dec(&sdata->bss->num_sta_ps);
sta_info_recalc_tim(sta);
}
local->num_sta--; local->num_sta--;
local->sta_generation++; local->sta_generation++;
@ -790,6 +781,15 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
*/ */
synchronize_rcu(); synchronize_rcu();
if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
BUG_ON(!sdata->bss);
clear_sta_flag(sta, WLAN_STA_PS_STA);
atomic_dec(&sdata->bss->num_sta_ps);
sta_info_recalc_tim(sta);
}
for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]); local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
__skb_queue_purge(&sta->ps_tx_buf[ac]); __skb_queue_purge(&sta->ps_tx_buf[ac]);