Commit 20d64713 authored by James Ketrenos's avatar James Ketrenos Committed by Jeff Garzik
Browse files

[PATCH] ieee80211: Fixed a kernel oops on module unload 



tree 367069f24fc38b4aa910e86ff40094d2078d8aa7
parent a33a1982
author James Ketrenos <jketreno@linux.intel.com> 1124430800 -0500
committer James Ketrenos <jketreno@linux.intel.com> 1127310571 -0500

Fixed a kernel oops on module unload by adding spin lock protection to
ieee80211's crypt handlers (thanks to Zhu Yi)

Modified scan result logic to report WPA and RSN IEs if set (vs.being
based on wpa_enabled)

Added ieee80211_device as the first parameter to the crypt init()
method.  TKIP modified to use that structure for determining whether to
countermeasures are active.

Signed-off-by: default avatarJames Ketrenos <jketreno@linux.intel.com>
Signed-off-by: default avatarJeff Garzik <jgarzik@pobox.com>
parent 4ca5253d

include/net/ieee80211.h

+1 −0
Original line number Diff line number Diff line
@@ -434,6 +434,7 @@ struct ieee80211_device; 
#define SEC_KEY_2         (1<<1)

#define SEC_KEY_3         (1<<2)

#define SEC_KEY_4         (1<<3)

#define SEC_KEY_MASK      (SEC_KEY_1 | SEC_KEY_2 | SEC_KEY_3 | SEC_KEY_4)

#define SEC_ACTIVE_KEY    (1<<4)

#define SEC_AUTH_MODE     (1<<5)

#define SEC_UNICAST_GROUP (1<<6)

include/net/ieee80211_crypt.h

+1 −1
Original line number Diff line number Diff line
@@ -31,7 +31,7 @@ struct ieee80211_crypto_ops { 
	/* init new crypto context (e.g., allocate private data space,

	 * select IV, etc.); returns NULL on failure or pointer to allocated

	 * private data on success */

	void *(*init) (int keyidx);

	void *(*init) (struct ieee80211_device * ieee, int keyidx);



	/* deinitialize crypto context and free allocated private data */

	void (*deinit) (void *priv);

net/ieee80211/ieee80211_crypt.c

+5 −4
Original line number Diff line number Diff line
@@ -41,7 +41,9 @@ void ieee80211_crypt_deinit_entries(struct ieee80211_device *ieee, int force) 
{

	struct list_head *ptr, *n;

	struct ieee80211_crypt_data *entry;

	unsigned long flags;



	spin_lock_irqsave(&ieee->lock, flags);

	for (ptr = ieee->crypt_deinit_list.next, n = ptr->next;

	     ptr != &ieee->crypt_deinit_list; ptr = n, n = ptr->next) {

		entry = list_entry(ptr, struct ieee80211_crypt_data, list);
@@ -57,14 +59,13 @@ void ieee80211_crypt_deinit_entries(struct ieee80211_device *ieee, int force) 
		}

		kfree(entry);

	}

	spin_unlock_irqrestore(&ieee->lock, flags);

}



void ieee80211_crypt_deinit_handler(unsigned long data)

{

	struct ieee80211_device *ieee = (struct ieee80211_device *)data;

	unsigned long flags;



	spin_lock_irqsave(&ieee->lock, flags);

	ieee80211_crypt_deinit_entries(ieee, 0);

	if (!list_empty(&ieee->crypt_deinit_list)) {

		printk(KERN_DEBUG "%s: entries remaining in delayed crypt "
@@ -72,7 +73,6 @@ void ieee80211_crypt_deinit_handler(unsigned long data) 
		ieee->crypt_deinit_timer.expires = jiffies + HZ;

		add_timer(&ieee->crypt_deinit_timer);

	}

	spin_unlock_irqrestore(&ieee->lock, flags);



}
@@ -182,7 +182,8 @@ struct ieee80211_crypto_ops *ieee80211_get_crypto_ops(const char *name) 
		return NULL;

}



static void *ieee80211_crypt_null_init(int keyidx)

static void *ieee80211_crypt_null_init(struct ieee80211_device *ieee,

				       int keyidx)

{

	return (void *)1;

}

net/ieee80211/ieee80211_crypt_ccmp.c

+1 −1
Original line number Diff line number Diff line
@@ -74,7 +74,7 @@ static void ieee80211_ccmp_aes_encrypt(struct crypto_tfm *tfm, 
	crypto_cipher_encrypt(tfm, &dst, &src, AES_BLOCK_LEN);

}



static void *ieee80211_ccmp_init(int key_idx)

static void *ieee80211_ccmp_init(struct ieee80211_device *ieee, int key_idx)

{

	struct ieee80211_ccmp_data *priv;

net/ieee80211/ieee80211_crypt_tkip.c

+28 −3
Original line number Diff line number Diff line
@@ -59,9 +59,11 @@ struct ieee80211_tkip_data { 


	/* scratch buffers for virt_to_page() (crypto API) */

	u8 rx_hdr[16], tx_hdr[16];



	struct ieee80211_device *ieee;

};



static void *ieee80211_tkip_init(int key_idx)

static void *ieee80211_tkip_init(struct ieee80211_device *ieee, int key_idx)

{

	struct ieee80211_tkip_data *priv;
@@ -69,6 +71,9 @@ static void *ieee80211_tkip_init(int key_idx) 
	if (priv == NULL)

		goto fail;

	memset(priv, 0, sizeof(*priv));



	priv->ieee = ieee;



	priv->key_idx = key_idx;



	priv->tfm_arc4 = crypto_alloc_tfm("arc4", 0);
@@ -264,11 +269,21 @@ static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv) 
	u32 crc;

	struct scatterlist sg;



	hdr = (struct ieee80211_hdr *)skb->data;



	if (tkey->ieee->tkip_countermeasures) {

		if (net_ratelimit()) {

			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "

			       "TX packet to " MAC_FMT "\n",

			       tkey->ieee->dev->name, MAC_ARG(hdr->addr1));

		}

		return -1;

	}



	if (skb_headroom(skb) < 8 || skb_tailroom(skb) < 4 ||

	    skb->len < hdr_len)

		return -1;



	hdr = (struct ieee80211_hdr *)skb->data;

	if (!tkey->tx_phase1_done) {

		tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2,

				   tkey->tx_iv32);
@@ -325,10 +340,20 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv) 
	struct scatterlist sg;

	int plen;



	hdr = (struct ieee80211_hdr *)skb->data;



	if (tkey->ieee->tkip_countermeasures) {

		if (net_ratelimit()) {

			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "

			       "received packet from " MAC_FMT "\n",

			       tkey->ieee->dev->name, MAC_ARG(hdr->addr2));

		}

		return -1;

	}



	if (skb->len < hdr_len + 8 + 4)

		return -1;



	hdr = (struct ieee80211_hdr *)skb->data;

	pos = skb->data + hdr_len;

	keyidx = pos[3];

	if (!(keyidx & (1 << 5))) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE