Commit 9e15ff7b authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'mac80211-for-davem-2018-10-04' of... 

Merge tag 'mac80211-for-davem-2018-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211



Johannes Berg says:

====================
Just three small fixes:
 * fix use-after-free in regulatory code
 * fix rx-mgmt key flag in AP mode (mac80211)
 * fix wireless extensions compat code memory leak
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents b576eddb 1db58529

net/mac80211/cfg.c

+1 −1
Original line number Diff line number Diff line
@@ -427,7 +427,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, 
	case NL80211_IFTYPE_AP:

	case NL80211_IFTYPE_AP_VLAN:

		/* Keys without a station are used for TX only */

		if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP))

		if (sta && test_sta_flag(sta, WLAN_STA_MFP))

			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;

		break;

	case NL80211_IFTYPE_ADHOC:

net/wireless/reg.c

+4 −3
Original line number Diff line number Diff line
@@ -2661,11 +2661,12 @@ static void reg_process_hint(struct regulatory_request *reg_request) 
{

	struct wiphy *wiphy = NULL;

	enum reg_request_treatment treatment;

	enum nl80211_reg_initiator initiator = reg_request->initiator;



	if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)

		wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);



	switch (reg_request->initiator) {

	switch (initiator) {

	case NL80211_REGDOM_SET_BY_CORE:

		treatment = reg_process_hint_core(reg_request);

		break;
@@ -2683,7 +2684,7 @@ static void reg_process_hint(struct regulatory_request *reg_request) 
		treatment = reg_process_hint_country_ie(wiphy, reg_request);

		break;

	default:

		WARN(1, "invalid initiator %d\n", reg_request->initiator);

		WARN(1, "invalid initiator %d\n", initiator);

		goto out_free;

	}
@@ -2698,7 +2699,7 @@ static void reg_process_hint(struct regulatory_request *reg_request) 
	 */

	if (treatment == REG_REQ_ALREADY_SET && wiphy &&

	    wiphy->regulatory_flags & REGULATORY_STRICT_REG) {

		wiphy_update_regulatory(wiphy, reg_request->initiator);

		wiphy_update_regulatory(wiphy, initiator);

		wiphy_all_share_dfs_chan_state(wiphy);

		reg_check_channels();

	}

net/wireless/wext-compat.c

+10 −4
Original line number Diff line number Diff line
@@ -1278,12 +1278,16 @@ static int cfg80211_wext_giwrate(struct net_device *dev, 
	if (err)

		return err;



	if (!(sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)))

		return -EOPNOTSUPP;

	if (!(sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE))) {

		err = -EOPNOTSUPP;

		goto free;

	}



	rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate);



	return 0;

free:

	cfg80211_sinfo_release_content(&sinfo);

	return err;

}



/* Get wireless statistics.  Called by /proc/net/wireless and by SIOCGIWSTATS */
@@ -1293,7 +1297,7 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev) 
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);

	/* we are under RTNL - globally locked - so can use static structs */

	static struct iw_statistics wstats;

	static struct station_info sinfo;

	static struct station_info sinfo = {};

	u8 bssid[ETH_ALEN];



	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION)
@@ -1352,6 +1356,8 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev) 
	if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED))

		wstats.discard.retries = sinfo.tx_failed;



	cfg80211_sinfo_release_content(&sinfo);



	return &wstats;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE