summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorHelmut Schaa <helmut.schaa@googlemail.com>2012-01-27 11:02:53 +0100
committerJohn W. Linville <linville@tuxdriver.com>2012-01-30 15:48:28 -0500
commit4f3eb0ba4817e55e1b5b2f63fcf3f266c328fc1a (patch)
treebd3d01eb44f353f4a012e53919bfc843c08a14d5 /net
parent19468413e8d98d44be8daf0acaf8d576dfc53fa2 (diff)
mac80211: Move num_sta_ps counter decrement after synchronize_rcu
Unted the assumption that the sta struct is still accessible before the synchronize_rcu call we should move the num_sta_ps counter decrement after synchronize_rcu to avoid incorrect decrements if num_sta_ps. Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net')
-rw-r--r--net/mac80211/sta_info.c18
1 files changed, 9 insertions, 9 deletions
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 1fb4770a7d13..fa0823892b2d 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -750,15 +750,6 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
sta->dead = true;
- if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
- BUG_ON(!sdata->bss);
-
- clear_sta_flag(sta, WLAN_STA_PS_STA);
-
- atomic_dec(&sdata->bss->num_sta_ps);
- sta_info_recalc_tim(sta);
- }
-
local->num_sta--;
local->sta_generation++;
@@ -790,6 +781,15 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
*/
synchronize_rcu();
+ if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
+ BUG_ON(!sdata->bss);
+
+ clear_sta_flag(sta, WLAN_STA_PS_STA);
+
+ atomic_dec(&sdata->bss->num_sta_ps);
+ sta_info_recalc_tim(sta);
+ }
+
for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
__skb_queue_purge(&sta->ps_tx_buf[ac]);