summaryrefslogtreecommitdiff
path: root/net/mac80211/key.h
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2010-07-27 02:52:03 +0400
committerJohn W. Linville <linville@tuxdriver.com>2010-07-27 22:59:58 +0400
commit32162a4dab0e6a4ca7f886a01173b5f9b80843be (patch)
treea8337e9b9788b787c13241ec9a9642527d5aad6a /net/mac80211/key.h
parent1b2fb7dc71c1f8f97663c2da84fa1c8183588474 (diff)
downloadlinux-32162a4dab0e6a4ca7f886a01173b5f9b80843be.tar.xz
mac80211: Fix key freeing to handle unlinked keys
Key locking simplification removed key->sdata != NULL verification from ieee80211_key_free(). While that is fine for most use cases, there is one path where this function can be called with an unlinked key (i.e., key->sdata == NULL && key->local == NULL). This results in a NULL pointer dereference with the current implementation. This is known to happen at least with FT protocol when wpa_supplicant tries to configure the key before association. Avoid the issue by passing in the local pointer to ieee80211_key_free(). In addition, do not clear the key from hw_accel or debugfs if it has not yet been added. At least the hw_accel one could trigger another NULL pointer dereference. Signed-off-by: Jouni Malinen <j@w1.fi> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/key.h')
-rw-r--r--net/mac80211/key.h3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index a3849fa3fce8..b665bbb7a471 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -135,7 +135,8 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
void ieee80211_key_link(struct ieee80211_key *key,
struct ieee80211_sub_if_data *sdata,
struct sta_info *sta);
-void ieee80211_key_free(struct ieee80211_key *key);
+void ieee80211_key_free(struct ieee80211_local *local,
+ struct ieee80211_key *key);
void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx);
void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
int idx);