diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2010-08-09 15:52:03 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-08-09 15:18:57 -0400 |
| commit | fe100acddf438591ecf3582cb57241e560da70b7 (patch) | |
| tree | a8fd5763ca3e161ce3de271289e7adec668795c0 | |
| parent | a9fda88b27e71d727b6c85b3792b34a8a4bebf13 (diff) | |
| download | lwn-fe100acddf438591ecf3582cb57241e560da70b7.tar.gz lwn-fe100acddf438591ecf3582cb57241e560da70b7.zip | |
cfg80211: fix locking in action frame TX
Accesses to "wdev->current_bss" must be
locked with the wdev lock, which action
frame transmission is missing.
Cc: stable@kernel.org [2.6.33+]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | net/wireless/mlme.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c index e74a1a2119d3..d1a3fb99fdf2 100644 --- a/net/wireless/mlme.c +++ b/net/wireless/mlme.c @@ -843,13 +843,19 @@ int cfg80211_mlme_action(struct cfg80211_registered_device *rdev, return -EINVAL; if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) { /* Verify that we are associated with the destination AP */ + wdev_lock(wdev); + if (!wdev->current_bss || memcmp(wdev->current_bss->pub.bssid, mgmt->bssid, ETH_ALEN) != 0 || (wdev->iftype == NL80211_IFTYPE_STATION && memcmp(wdev->current_bss->pub.bssid, mgmt->da, - ETH_ALEN) != 0)) + ETH_ALEN) != 0)) { + wdev_unlock(wdev); return -ENOTCONN; + } + + wdev_unlock(wdev); } if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0) |