two possible bugs

[Porsch, Marco]

Hi list,

1st) I think in hwmp_route_info_get a PREQ should only be processed, if it has the same SN an better metric (instead of better or equal).

2nd) In hwmp_prep_frame_process: u8 next_hop[ETH_ALEN] is written to, but never used. Should be used to buffer mpath->next_hop->sta.addr for use out of lock.

Files taken from compat-wireless-2010-02-02.

Regards
Marco


--- mesh_hwmp.c~	2010-02-18 14:44:47.000000000 +0100
+++ mesh_hwmp.c	2010-02-18 14:45:32.000000000 +0100
@@ -391,7 +391,7 @@ static u32 hwmp_route_info_get(struct ie
 				if (SN_GT(mpath->sn, orig_sn) ||
 				    (mpath->sn == orig_sn &&
 				     action == MPATH_PREQ &&
-				     new_metric > mpath->metric)) {
+				     new_metric >= mpath->metric)) {
 					process = false;
 					fresh_info = false;
 				}
@@ -611,7 +611,7 @@ static void hwmp_prep_frame_process(stru
 
 	mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr,
 		cpu_to_le32(orig_sn), 0, target_addr,
-		cpu_to_le32(target_sn), mpath->next_hop->sta.addr, hopcount,
+		cpu_to_le32(target_sn), next_hop, hopcount,
 		ttl, cpu_to_le32(lifetime), cpu_to_le32(metric),
 		0, sdata);
 	rcu_read_unlock();