1. 28 9月, 2010 3 次提交
  2. 25 9月, 2010 1 次提交
    • J
      mac80211: fix use-after-free · cd87a2d3
      Johannes Berg 提交于
      commit 8c0c709e
      Author: Johannes Berg <johannes@sipsolutions.net>
      Date:   Wed Nov 25 17:46:15 2009 +0100
      
          mac80211: move cmntr flag out of rx flags
      
      moved the CMTR flag into the skb's status, and
      in doing so introduced a use-after-free -- when
      the skb has been handed to cooked monitors the
      status setting will touch now invalid memory.
      
      Additionally, moving it there has effectively
      discarded the optimisation -- since the bit is
      only ever set on freed SKBs, and those were a
      copy, it could never be checked.
      
      For the current release, fixing this properly
      is a bit too involved, so let's just remove the
      problematic code and leave userspace with one
      copy of each frame for each virtual interface.
      
      Cc: stable@kernel.org [2.6.33+]
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      cd87a2d3
  3. 17 9月, 2010 1 次提交
  4. 28 8月, 2010 2 次提交
  5. 26 8月, 2010 2 次提交
  6. 25 8月, 2010 1 次提交
  7. 17 8月, 2010 6 次提交
  8. 29 6月, 2010 1 次提交
  9. 24 6月, 2010 1 次提交
  10. 16 6月, 2010 1 次提交
  11. 15 6月, 2010 7 次提交
  12. 05 6月, 2010 1 次提交
    • J
      mac80211: process station blockack action frames from work · 8b9a4e6e
      Johannes Berg 提交于
      Processing an association response could take a bit
      of time while we set up the hardware etc. During that
      time, the AP might already send a blockack request.
      If this happens very quickly on a fairly slow machine,
      we can end up processing the blockack request before
      the association processing has finished. Since the
      blockack processing cannot sleep right now, we also
      cannot make it wait in the driver.
      
      As a result, sometimes on slow machines the iwlagn
      driver gets totally confused, and no traffic can pass
      when the aggregation setup was done before the assoc
      setup completed.
      
      I'm working on a proper fix for this, which involves
      queuing all blockack category action frames from a
      work struct, and also allowing the ampdu_action driver
      callback to sleep, which will generally clean up the
      code and make things easier.
      
      However, this is a very involved and complex change.
      To fix the problem at hand in a way that can also be
      backported to stable, I've come up with this patch.
      Here, I simply process all aggregation action frames
      from the managed interface skb queue, which means
      their processing will be serialized with processing
      the association response, thereby fixing the problem.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Cc: stable@kernel.org
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      8b9a4e6e
  13. 04 6月, 2010 2 次提交
  14. 03 6月, 2010 1 次提交
  15. 02 6月, 2010 1 次提交
  16. 13 5月, 2010 1 次提交
  17. 01 5月, 2010 1 次提交
  18. 10 4月, 2010 1 次提交
  19. 09 4月, 2010 1 次提交
  20. 08 4月, 2010 4 次提交
  21. 07 4月, 2010 1 次提交