summaryrefslogtreecommitdiffstats
path: root/net/mac80211
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2011-01-03 19:42:24 +0100
committerJohn W. Linville <linville@tuxdriver.com>2011-01-04 14:17:23 -0500
commitd2460f4b2fa6dbdeec800414f9cf5b1fc8b71197 (patch)
tree01ce2bf5ec6b29143b3e0003ffbf05812f6bb7c0 /net/mac80211
parent919bbad580445801c22ef6ccbe624551fee652bd (diff)
downloadlinux-d2460f4b2fa6dbdeec800414f9cf5b1fc8b71197.tar.gz
linux-d2460f4b2fa6dbdeec800414f9cf5b1fc8b71197.tar.bz2
linux-d2460f4b2fa6dbdeec800414f9cf5b1fc8b71197.zip
mac80211: add missing synchronize_rcu
commit ad0e2b5a00dbec303e4682b403bb6703d11dcdb2 Author: Johannes Berg <johannes.berg@intel.com> Date: Tue Jun 1 10:19:19 2010 +0200 mac80211: simplify key locking removed the synchronization against RCU and thus opened a race window where we can use a key for TX while it is already freed. Put a synchronisation into the right place to close that window. Reported-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> Cc: stable@kernel.org [2.6.36+] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211')
-rw-r--r--net/mac80211/key.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ccd676b2f599..aa1b734a5e99 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -366,6 +366,12 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
if (!key)
return;
+ /*
+ * Synchronize so the TX path can no longer be using
+ * this key before we free/remove it.
+ */
+ synchronize_rcu();
+
if (key->local)
ieee80211_key_disable_hw_accel(key);