Johannes Berg 4253119acf mac80211: fix two remote exploits
Lennert Buytenhek noticed a remotely triggerable problem
in mac80211, which is due to some code shuffling I did
that ended up changing the order in which things were
done -- this was in

  commit d75636ef9c1af224f1097941879d5a8db7cd04e5
  Author: Johannes Berg <johannes@sipsolutions.net>
  Date:   Tue Feb 10 21:25:53 2009 +0100

    mac80211: RX aggregation: clean up stop session

The problem is that the BUG_ON moved before the various
checks, and as such can be triggered.

As the comment indicates, the BUG_ON can be removed since
the ampdu_action callback must already exist when the
state is OPERATIONAL.

A similar code path leads to a WARN_ON in
ieee80211_stop_tx_ba_session, which can also be removed.

Cc: stable@kernel.org [2.6.29+]
Cc: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-30 13:52:21 -05:00
..
2009-11-30 13:52:21 -05:00
2009-11-30 13:52:21 -05:00
2009-07-24 15:05:30 -04:00
2009-07-10 15:01:49 -04:00
2009-10-30 15:50:24 -04:00
2009-11-19 11:08:39 -05:00
2009-07-10 15:01:48 -04:00
2009-08-28 14:40:34 -04:00
2009-07-24 15:05:30 -04:00
2009-09-23 11:35:53 -04:00
2009-05-20 14:46:25 -04:00
2009-10-07 16:33:49 -04:00
2009-05-06 15:14:37 -04:00
2009-11-19 11:08:39 -05:00
2009-07-24 15:05:09 -04:00
2009-07-24 15:05:09 -04:00
2009-07-24 15:05:30 -04:00
2009-07-24 15:05:30 -04:00
2009-07-10 15:01:49 -04:00