From: Luis Carlos Cobo <luisca@cozybit.com>
Date: Fri, 29 Feb 2008 22:49:37 +0000 (-0800)
Subject: mac80211: delete mesh_path timer on mesh_path removal
X-Git-Tag: v2.6.26-rc1~1138^2~454^2~49
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=89a1ad6990d884796c5280d13aa58d216dffa08d;p=linux-2.6

mac80211: delete mesh_path timer on mesh_path removal

This avoids dereferencing a no longer existing struct mesh_path.

Signed-off-by: Luis Carlos Cobo <luisca@cozybit.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index ab4d757c45..bd58849f9d 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -301,6 +301,7 @@ static void mesh_path_node_reclaim(struct rcu_head *rp)
 	struct ieee80211_sub_if_data *sdata =
 		IEEE80211_DEV_TO_SUB_IF(node->mpath->dev);
 
+	del_timer_sync(&node->mpath->timer);
 	atomic_dec(&sdata->u.sta.mpaths);
 	kfree(node->mpath);
 	kfree(node);