• Johannes Berg's avatar
    mac80211: properly free requested-but-not-started TX agg sessions · 33ddd81e
    Johannes Berg authored
    When deleting a station or otherwise tearing down all aggregation
    sessions, make sure to delete requested but not yet started ones,
    to avoid the following scenario:
    
     * session is requested, added to tid_start_tx[]
     * ieee80211_ba_session_work() runs, gets past BLOCK_BA check
     * ieee80211_sta_tear_down_BA_sessions() runs, locks &sta->ampdu_mlme.mtx,
       e.g. while deleting the station - deleting all active sessions
     * ieee80211_ba_session_work() continues since tear down flushes it, and
       calls ieee80211_tx_ba_session_handle_start() for the new session, arms
       the timer for it
     * station deletion continues to __cleanup_single_sta() and frees the
       session struct, while the timer is armed
    Reported-by: default avatarFengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    33ddd81e
agg-tx.c 28.5 KB