diff options
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/key.c | 6 | ||||
| -rw-r--r-- | net/mac80211/rx.c | 3 |
2 files changed, 9 insertions, 0 deletions
diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 315ee301b75..8c02469b717 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -375,6 +375,12 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key) if (!key) return; + /* + * Synchronize so the TX path can no longer be using + * this key before we free/remove it. + */ + synchronize_rcu(); + if (key->local) ieee80211_key_disable_hw_accel(key); diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 9595e564bad..2b9db5ab904 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1808,6 +1808,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) if (!fwd_skb && net_ratelimit()) printk(KERN_DEBUG "%s: failed to clone mesh frame\n", sdata->name); + if (!fwd_skb) + goto out; fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); @@ -1845,6 +1847,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) } } + out: if (is_multicast_ether_addr(hdr->addr1) || sdata->dev->flags & IFF_PROMISC) return RX_CONTINUE; |