summaryrefslogtreecommitdiffstats
path: root/net/mac80211/agg-tx.c
diff options
context:
space:
mode:
authorYogesh Ashok Powar <yogeshp@marvell.com>2011-12-08 14:56:15 +0530
committerJohn W. Linville <linville@tuxdriver.com>2011-12-13 15:30:33 -0500
commit42624d4913a00219a8fdbb4bafd634d1d843be85 (patch)
tree0cf641329ff23e4ca159e44506ffa74cf9f9b623 /net/mac80211/agg-tx.c
parentadbde344dc12514d68620afae8d34035e72544b1 (diff)
downloadlinux-42624d4913a00219a8fdbb4bafd634d1d843be85.tar.gz
linux-42624d4913a00219a8fdbb4bafd634d1d843be85.tar.bz2
linux-42624d4913a00219a8fdbb4bafd634d1d843be85.zip
mac80211: Purge A-MPDU TX queues before station destructions
When a station leaves suddenly while ampdu traffic to that station is still running, there is a possibility that the ampdu pending queues are not freed due to a race condition leading to memory leaks. In '__sta_info_destroy' when we attempt to destroy the ampdu sessions in 'ieee80211_sta_tear_down_BA_sessions', the driver calls 'ieee80211_stop_tx_ba_cb_irqsafe' to delete the ampdu structures (tid_tx) and splice the pending queues and this job gets queued in sdata workqueue. However, the sta entry can get destroyed before the above work gets scheduled and hence the race. Purging the queues and freeing the tid_tx to avoid the leak. The better solution would be to fix the race, but that can be taken up in a separate patch. Signed-off-by: Nishant Sarmukadam <nishants@marvell.com> Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/agg-tx.c')
-rw-r--r--net/mac80211/agg-tx.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c45fa5df0d41..5c7f0c3c74cb 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -55,6 +55,8 @@
* @ampdu_action function will be called with the action
* %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail,
* and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe().
+ * Note that the sta can get destroyed before the BA tear down is
+ * complete.
*/
static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,