https://github.com/torvalds/linux
Revision 4253119acf412fd686ef4bd8749b5a4d70ea3a51 authored by Johannes Berg on 20 November 2009, 08:15:51 UTC, committed by John W. Linville on 30 November 2009, 18:52:21 UTC
Lennert Buytenhek noticed a remotely triggerable problem in mac80211, which is due to some code shuffling I did that ended up changing the order in which things were done -- this was in commit d75636ef9c1af224f1097941879d5a8db7cd04e5 Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Feb 10 21:25:53 2009 +0100 mac80211: RX aggregation: clean up stop session The problem is that the BUG_ON moved before the various checks, and as such can be triggered. As the comment indicates, the BUG_ON can be removed since the ampdu_action callback must already exist when the state is OPERATIONAL. A similar code path leads to a WARN_ON in ieee80211_stop_tx_ba_session, which can also be removed. Cc: stable@kernel.org [2.6.29+] Cc: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
1 parent 3e98484
Tip revision: 4253119acf412fd686ef4bd8749b5a4d70ea3a51 authored by Johannes Berg on 20 November 2009, 08:15:51 UTC
mac80211: fix two remote exploits
mac80211: fix two remote exploits
Tip revision: 4253119
File | Mode | Size |
---|---|---|
accessibility | ||
acpi | ||
amba | ||
ata | ||
atm | ||
auxdisplay | ||
base | ||
block | ||
bluetooth | ||
cdrom | ||
char | ||
clocksource | ||
connector | ||
cpufreq | ||
cpuidle | ||
crypto | ||
dca | ||
dio | ||
dma | ||
edac | ||
eisa | ||
firewire | ||
firmware | ||
gpio | ||
gpu | ||
hid | ||
hwmon | ||
i2c | ||
ide | ||
idle | ||
ieee1394 | ||
ieee802154 | ||
infiniband | ||
input | ||
isdn | ||
leds | ||
lguest | ||
macintosh | ||
mca | ||
md | ||
media | ||
memstick | ||
message | ||
mfd | ||
misc | ||
mmc | ||
mtd | ||
net | ||
nubus | ||
of | ||
oprofile | ||
parisc | ||
parport | ||
pci | ||
pcmcia | ||
platform | ||
pnp | ||
power | ||
pps | ||
ps3 | ||
rapidio | ||
regulator | ||
rtc | ||
s390 | ||
sbus | ||
scsi | ||
serial | ||
sfi | ||
sh | ||
sn | ||
spi | ||
ssb | ||
staging | ||
tc | ||
telephony | ||
thermal | ||
uio | ||
usb | ||
uwb | ||
video | ||
virtio | ||
vlynq | ||
w1 | ||
watchdog | ||
xen | ||
zorro | ||
Kconfig | -rw-r--r-- | 1.9 KB |
Makefile | -rw-r--r-- | 3.2 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...