From d082a97f04f13e0ae8e1292cfe462ced27569ee8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 9 Dec 2010 12:16:33 -0800 Subject: [PATCH] .36 patch removal as it was a duplicate --- ...mac80211-delete-addba-response-timer.patch | 45 ------------------- review-2.6.36/series | 1 - 2 files changed, 46 deletions(-) delete mode 100644 review-2.6.36/mac80211-delete-addba-response-timer.patch diff --git a/review-2.6.36/mac80211-delete-addba-response-timer.patch b/review-2.6.36/mac80211-delete-addba-response-timer.patch deleted file mode 100644 index e62a550de8f..00000000000 --- a/review-2.6.36/mac80211-delete-addba-response-timer.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 44271488b91c9eecf249e075a1805dd887e222d2 Mon Sep 17 00:00:00 2001 -From: Johannes Berg -Date: Tue, 5 Oct 2010 21:40:33 +0200 -Subject: mac80211: delete AddBA response timer - -From: Johannes Berg - -commit 44271488b91c9eecf249e075a1805dd887e222d2 upstream. - -We never delete the addBA response timer, which -is typically fine, but if the station it belongs -to is deleted very quickly after starting the BA -session, before the peer had a chance to reply, -the timer may fire after the station struct has -been freed already. Therefore, we need to delete -the timer in a suitable spot -- best when the -session is being stopped (which will happen even -then) in which case the delete will be a no-op -most of the time. - -I've reproduced the scenario and tested the fix. - -This fixes the crash reported at -http://mid.gmane.org/4CAB6F96.6090701@candelatech.com - -Reported-by: Ben Greear -Signed-off-by: Johannes Berg -Signed-off-by: John W. Linville -Signed-off-by: Greg Kroah-Hartman - ---- - net/mac80211/agg-tx.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/net/mac80211/agg-tx.c -+++ b/net/mac80211/agg-tx.c -@@ -177,6 +177,8 @@ int ___ieee80211_stop_tx_ba_session(stru - - del_timer_sync(&tid_tx->addba_resp_timer); - -+ del_timer_sync(&tid_tx->addba_resp_timer); -+ - /* - * After this packets are no longer handed right through - * to the driver but are put onto tid_tx->pending instead, diff --git a/review-2.6.36/series b/review-2.6.36/series index 889b3ab1ac6..2611c249370 100644 --- a/review-2.6.36/series +++ b/review-2.6.36/series @@ -57,7 +57,6 @@ mac80211-clear-txflags-for-ps-filtered-frames.patch mac80211-reset-probe-send-counter-upon-connection-timer-reset.patch mac80211-fix-ibss-station-got-expired-immediately.patch mac80211-don-t-sanitize-invalid-rates.patch -mac80211-delete-addba-response-timer.patch isdn-gigaset-fix-bas_gigaset-at-read-error-handling.patch isdn-gigaset-correct-bas_gigaset-rx-buffer-handling.patch isdn-gigaset-bas_gigaset-locking-fix.patch -- 2.47.3