openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Just three small fixes: 

* fix use-after-free in regulatory code
  * fix rx-mgmt key flag in AP mode (mac80211)
  * fix wireless extensions compat code memory leak
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEH1e1rEeCd0AIMq6MB8qZga/fl8QFAlu2bEUACgkQB8qZga/f
 l8RAgw/7BfRpm3Kr7XW919naGkt/pQeJxUcuF9YggBpTCrp/DSLQYsjOBE5DyS/m
 728oPD8jEDehUHasWKsbG7wit1S7ImExCHTPim8C1mbABhbqdhwD4ceUvBO7RYi2
 p0+yN8X8z5D0qruMrNwhtxdE8iV9bBgmY6u1jubpJFkKLPf2euZyroH40b879CIn
 aHqB42GNJCdwO2UFaPDH2cdx5DFWrDlfA1LGbrbuzrXMBfNGWYgen2JJH/5iDOyU
 1rVXk/pUpVffp0Zde+66NtyCxxC0+hQwrTczEKXICb5qoWJpz6kugFGGO1oDQgdp
 AbM7KNrV712h/qwTEnC1NG0KUXgocpwWIuf/cuTow0vGUJSl+O2pLS/3GLOwH2du
 1u/FF4LiBc4NFXmWBPMN3LUN+Ica0/YWSbVwcv2c4guemV1EOGinlbFc+tnoue7M
 fpLkQJUYCiEVFRXGWVaSl0Hr6z+zwgfa8qHYN2yq1qyB0dYHryYiVhgKLV7yisCm
 RNy1hmVuV7rMsL3f4iUq/2xnL3U8qK1+19Mr+i58/kU4Tx2jMkWj0kivRdgYX4EN
 XcBhJzWXrb3yMldACrCji6iRnrFMqg7osyEgFiMLMl4cZfs057+qsrJyR5xajVOi
 Ws+hj3a1LukJ1nIhou4uOLAt9D7ohuJojQq6D2GLeBwfGPNkz4E=
 =QyWK
 -----END PGP SIGNATURE-----

Merge tag 'mac80211-for-davem-2018-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

Johannes Berg says:

====================
Just three small fixes:
 * fix use-after-free in regulatory code
 * fix rx-mgmt key flag in AP mode (mac80211)
 * fix wireless extensions compat code memory leak
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2018-10-04 13:47:39 -07:00
parent b576eddb5d 1db5852945
commit 9e15ff7b89
3 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/mac80211/cfg.c
View File

@ -427,7 +427,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
case NL80211_IFTYPE_AP: case NL80211_IFTYPE_AP:
case NL80211_IFTYPE_AP_VLAN: case NL80211_IFTYPE_AP_VLAN:
/* Keys without a station are used for TX only */ /* Keys without a station are used for TX only */
if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP)) if (sta && test_sta_flag(sta, WLAN_STA_MFP))
key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT; key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
break; break;
case NL80211_IFTYPE_ADHOC: case NL80211_IFTYPE_ADHOC:

7
net/wireless/reg.c
View File

@ -2661,11 +2661,12 @@ static void reg_process_hint(struct regulatory_request *reg_request)
{ {
struct wiphy *wiphy = NULL; struct wiphy *wiphy = NULL;
enum reg_request_treatment treatment; enum reg_request_treatment treatment;
enum nl80211_reg_initiator initiator = reg_request->initiator;
if (reg_request->wiphy_idx != WIPHY_IDX_INVALID) if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx); wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
switch (reg_request->initiator) { switch (initiator) {
case NL80211_REGDOM_SET_BY_CORE: case NL80211_REGDOM_SET_BY_CORE:
treatment = reg_process_hint_core(reg_request); treatment = reg_process_hint_core(reg_request);
break; break;
@ -2683,7 +2684,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
treatment = reg_process_hint_country_ie(wiphy, reg_request); treatment = reg_process_hint_country_ie(wiphy, reg_request);
break; break;
default: default:
WARN(1, "invalid initiator %d\n", reg_request->initiator); WARN(1, "invalid initiator %d\n", initiator);
goto out_free; goto out_free;
} }
@ -2698,7 +2699,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
*/ */
if (treatment == REG_REQ_ALREADY_SET && wiphy && if (treatment == REG_REQ_ALREADY_SET && wiphy &&
wiphy->regulatory_flags & REGULATORY_STRICT_REG) { wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
wiphy_update_regulatory(wiphy, reg_request->initiator); wiphy_update_regulatory(wiphy, initiator);
wiphy_all_share_dfs_chan_state(wiphy); wiphy_all_share_dfs_chan_state(wiphy);
reg_check_channels(); reg_check_channels();
} }

14
net/wireless/wext-compat.c
View File

@ -1278,12 +1278,16 @@ static int cfg80211_wext_giwrate(struct net_device *dev,
if (err) if (err)
return err; return err;
if (!(sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE))) if (!(sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE))) {
return -EOPNOTSUPP; err = -EOPNOTSUPP;
goto free;
}
rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate); rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate);
return 0; free:
cfg80211_sinfo_release_content(&sinfo);
return err;
} }
/* Get wireless statistics. Called by /proc/net/wireless and by SIOCGIWSTATS */ /* Get wireless statistics. Called by /proc/net/wireless and by SIOCGIWSTATS */
@ -1293,7 +1297,7 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
/* we are under RTNL - globally locked - so can use static structs */ /* we are under RTNL - globally locked - so can use static structs */
static struct iw_statistics wstats; static struct iw_statistics wstats;
static struct station_info sinfo; static struct station_info sinfo = {};
u8 bssid[ETH_ALEN]; u8 bssid[ETH_ALEN];
if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION)
@ -1352,6 +1356,8 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED)) if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED))
wstats.discard.retries = sinfo.tx_failed; wstats.discard.retries = sinfo.tx_failed;
cfg80211_sinfo_release_content(&sinfo);
return &wstats; return &wstats;
} }