[PATCH 1/1] mac80211: fix an oops in several failure paths in key allocation

[PATCH 1/1] mac80211: fix an oops in several failure paths in key allocation

[Tomas Winkler]

From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This patch fixes an oops in several failure paths in key allocation. This
Oops occurs when freeing a key that has not been linked yet, so the
key->sdata is not set.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
---
 net/mac80211/key.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index d4893bd..6597c77 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -387,6 +387,15 @@ void ieee80211_key_free(struct ieee80211_key *key)
 	if (!key)
 		return;
 
+	if (!key->sdata) {
+		/* The key has not been linked yet, simply free it
+		 * and don't Oops */
+		if (key->conf.alg == ALG_CCMP)
+			ieee80211_aes_key_free(key->u.ccmp.tfm);
+		kfree(key);
+		return;
+	}
+
 	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
 	__ieee80211_key_free(key);
 	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
-- 
1.5.4.1

---------------------------------------------------------------------
Intel Israel (74) Limited

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.

Re: [PATCH 1/1] mac80211: fix an oops in several failure paths in key allocation

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 1231 bytes --]

On Thu, 2008-06-26 at 12:13 +0300, Tomas Winkler wrote:
> From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
> 
> This patch fixes an oops in several failure paths in key allocation. This
> Oops occurs when freeing a key that has not been linked yet, so the
> key->sdata is not set.
> 
> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>

Acked-by: Johannes Berg <johannes@sipsolutions.net>

> ---
>  net/mac80211/key.c |    9 +++++++++
>  1 files changed, 9 insertions(+), 0 deletions(-)
> 
> diff --git a/net/mac80211/key.c b/net/mac80211/key.c
> index d4893bd..6597c77 100644
> --- a/net/mac80211/key.c
> +++ b/net/mac80211/key.c
> @@ -387,6 +387,15 @@ void ieee80211_key_free(struct ieee80211_key *key)
>  	if (!key)
>  		return;
>  
> +	if (!key->sdata) {
> +		/* The key has not been linked yet, simply free it
> +		 * and don't Oops */
> +		if (key->conf.alg == ALG_CCMP)
> +			ieee80211_aes_key_free(key->u.ccmp.tfm);
> +		kfree(key);
> +		return;
> +	}
> +
>  	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
>  	__ieee80211_key_free(key);
>  	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]