aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2009-11-30 19:47:16 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2009-11-30 19:47:16 -0500
commit29e553631b2a0d4eebd23db630572e1027a9967a (patch)
treea891e02cc245ac9c14dc47528120e262d0298698 /drivers
parented9fd93e9a0c327e5d02313ba6e233c8e76da118 (diff)
parent827d42c9ac91ddd728e4f4a31fefb906ef2ceff7 (diff)
Merge branch 'security' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
* 'security' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6: mac80211: fix spurious delBA handling mac80211: fix two remote exploits
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/wireless/iwlwifi/iwl-tx.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index fb9bcfa6d947..b7e196e3c8d3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1277,8 +1277,16 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
1277 return -ENXIO; 1277 return -ENXIO;
1278 } 1278 }
1279 1279
1280 if (priv->stations[sta_id].tid[tid].agg.state ==
1281 IWL_EMPTYING_HW_QUEUE_ADDBA) {
1282 IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
1283 ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid);
1284 priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
1285 return 0;
1286 }
1287
1280 if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON) 1288 if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
1281 IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n"); 1289 IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
1282 1290
1283 tid_data = &priv->stations[sta_id].tid[tid]; 1291 tid_data = &priv->stations[sta_id].tid[tid];
1284 ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4; 1292 ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;