summaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorKirill Tkhai <ktkhai@parallels.com>2014-02-14 16:17:49 +0400
committerJohn W. Linville <linville@tuxdriver.com>2014-02-20 15:49:07 -0500
commit72471c0d3197d02da53897868692f0b91042f8a5 (patch)
tree83d3447d12c5b474ac26b302be4cc4273737bd1c /drivers/net
parentd421c62e37c9c83496fa721d4f4cd4a6cae82151 (diff)
downloadop-kernel-dev-72471c0d3197d02da53897868692f0b91042f8a5.zip
op-kernel-dev-72471c0d3197d02da53897868692f0b91042f8a5.tar.gz
hostap: Do not free priv until timer handler has actually stopped using it
Function del_timer() does not guarantee that timer was really deleted. If the timer handler is beeing executed at the moment, the function does nothing. So, it's possible to use already freed memory in the handler: [ref: Documentation/DocBook/kernel-locking.tmpl] This was found using grep and compile-tested only. Please, consider applying or something similar to it. Signed-off-by: Kirill Tkhai <ktkhai@parallels.com> CC: Jouni Malinen <j@w1.fi> CC: John W. Linville <linville@tuxdriver.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/wireless/hostap/hostap_ap.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index d36e252..5965255 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -147,7 +147,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
if (!sta->ap && sta->u.sta.challenge)
kfree(sta->u.sta.challenge);
- del_timer(&sta->timer);
+ del_timer_sync(&sta->timer);
#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
kfree(sta);
OpenPOWER on IntegriCloud