diff options
| author | Jouni Malinen <j@w1.fi> | 2010-07-26 15:52:03 -0700 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-07-27 14:59:58 -0400 |
| commit | 32162a4dab0e6a4ca7f886a01173b5f9b80843be (patch) | |
| tree | a8337e9b9788b787c13241ec9a9642527d5aad6a /net/mac80211/sta_info.c | |
| parent | 1b2fb7dc71c1f8f97663c2da84fa1c8183588474 (diff) | |
| download | op-kernel-dev-32162a4dab0e6a4ca7f886a01173b5f9b80843be.zip op-kernel-dev-32162a4dab0e6a4ca7f886a01173b5f9b80843be.tar.gz | |
mac80211: Fix key freeing to handle unlinked keys
Key locking simplification removed key->sdata != NULL verification from
ieee80211_key_free(). While that is fine for most use cases, there is one
path where this function can be called with an unlinked key (i.e.,
key->sdata == NULL && key->local == NULL). This results in a NULL pointer
dereference with the current implementation. This is known to happen at
least with FT protocol when wpa_supplicant tries to configure the key
before association.
Avoid the issue by passing in the local pointer to
ieee80211_key_free(). In addition, do not clear the key from hw_accel
or debugfs if it has not yet been added. At least the hw_accel one could
trigger another NULL pointer dereference.
Signed-off-by: Jouni Malinen <j@w1.fi>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/sta_info.c')
| -rw-r--r-- | net/mac80211/sta_info.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index 67656cb..6d86f0c 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -647,7 +647,7 @@ static int __must_check __sta_info_destroy(struct sta_info *sta) return ret; if (sta->key) { - ieee80211_key_free(sta->key); + ieee80211_key_free(local, sta->key); WARN_ON(sta->key); } |
