diff options
| author | Lennert Buytenhek <buytenh@wantstofly.org> | 2015-07-21 17:44:47 +0300 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2015-07-30 14:08:55 +0200 |
| commit | c22ff7b4e74d8136a9911d8b8d0f25f9f7c3edc1 (patch) | |
| tree | 172c0937f69b785793e1f2e63776341833c5800b /net/mac802154/ieee802154_i.h | |
| parent | 8b44f0dd2f90acd6c8842537223b39f890f2e713 (diff) | |
| download | linux-c22ff7b4e74d8136a9911d8b8d0f25f9f7c3edc1.tar.bz2 | |
mac802154: Fix memory corruption with global deferred transmit state.
When transmitting a packet via a mac802154 driver that can sleep in
its transmit function, mac802154 defers the call to the driver's
transmit function to a per-device workqueue.
However, mac802154 uses a single global work_struct for this, which
means that if you have more than one registered mac802154 interface
in the system, and you transmit on more than one of them at the same
time, you'll very easily cause memory corruption.
This patch moves the deferred transmit processing state from global
variables to struct ieee802154_local, and this seems to fix the memory
corruption issue.
Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Acked-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/mac802154/ieee802154_i.h')
| -rw-r--r-- | net/mac802154/ieee802154_i.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/mac802154/ieee802154_i.h b/net/mac802154/ieee802154_i.h index 6810d7a25aca..56ccffa3f2bf 100644 --- a/net/mac802154/ieee802154_i.h +++ b/net/mac802154/ieee802154_i.h @@ -60,6 +60,9 @@ struct ieee802154_local { struct tasklet_struct tasklet; struct sk_buff_head skb_queue; + + struct sk_buff *tx_skb; + struct work_struct tx_work; }; enum { @@ -125,6 +128,7 @@ ieee802154_sdata_running(struct ieee802154_sub_if_data *sdata) extern struct ieee802154_mlme_ops mac802154_mlme_wpan; void ieee802154_rx(struct ieee802154_local *local, struct sk_buff *skb); +void ieee802154_xmit_worker(struct work_struct *work); netdev_tx_t ieee802154_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev); netdev_tx_t |