public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Felix Fietkau <nbd@openwrt.org>,
	"John W. Linville" <linville@tuxdriver.com>
Subject: [ 11/33] ath9k: fix key allocation error handling for powersave keys
Date: Fri, 17 May 2013 14:49:55 -0700	[thread overview]
Message-ID: <20130517214918.065244208@linuxfoundation.org> (raw)
In-Reply-To: <20130517214916.821259930@linuxfoundation.org>

3.0-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Felix Fietkau <nbd@openwrt.org>

commit 4ef69d0394cba8caa9f75d3f2e53429bfb8b3045 upstream.

If no keycache slots are available, ath_key_config can return -ENOSPC.
If the key index is not checked for errors, it can lead to logspam that
looks like this: "ath: wiphy0: keyreset: keycache entry 228 out of range"
This can cause follow-up errors if the invalid keycache index gets
used for tx.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ath/ath9k/main.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1791,6 +1791,7 @@ static int ath9k_sta_add(struct ieee8021
 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 	struct ath_node *an = (struct ath_node *) sta->drv_priv;
 	struct ieee80211_key_conf ps_key = { };
+	int key;
 
 	ath_node_attach(sc, sta);
 
@@ -1798,7 +1799,9 @@ static int ath9k_sta_add(struct ieee8021
 	    vif->type != NL80211_IFTYPE_AP_VLAN)
 		return 0;
 
-	an->ps_key = ath_key_config(common, vif, sta, &ps_key);
+	key = ath_key_config(common, vif, sta, &ps_key);
+	if (key > 0)
+		an->ps_key = key;
 
 	return 0;
 }
@@ -1815,6 +1818,7 @@ static void ath9k_del_ps_key(struct ath_
 	    return;
 
 	ath_key_delete(common, &ps_key);
+	an->ps_key = 0;
 }
 
 static int ath9k_sta_remove(struct ieee80211_hw *hw,



  parent reply	other threads:[~2013-05-17 21:49 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-05-17 21:49 [ 00/33] 3.0.79-stable review Greg Kroah-Hartman
2013-05-17 21:49 ` [ 01/33] KVM: VMX: fix halt emulation while emulating invalid guest sate Greg Kroah-Hartman
2013-05-17 21:49 ` [ 02/33] ARM: OMAP: RX-51: change probe order of touchscreen and panel SPI devices Greg Kroah-Hartman
2013-05-17 21:49 ` [ 03/33] ASoC: wm8994: missing break in wm8994_aif3_hw_params() Greg Kroah-Hartman
2013-05-17 21:49 ` [ 04/33] ACPICA: Fix possible buffer overflow during a field unit read operation Greg Kroah-Hartman
2013-05-17 21:49 ` [ 05/33] dm snapshot: fix error return code in snapshot_ctr Greg Kroah-Hartman
2013-05-17 21:49 ` [ 06/33] xen/vcpu/pvhvm: Fix vcpu hotplugging hanging Greg Kroah-Hartman
2013-05-17 21:49 ` [ 07/33] SCSI: sd: fix array cache flushing bug causing performance problems Greg Kroah-Hartman
2013-05-17 21:49 ` [ 08/33] timer: Dont reinitialize the cpu base lock during CPU_UP_PREPARE Greg Kroah-Hartman
2013-05-17 21:49 ` [ 09/33] tick: Cleanup NOHZ per cpu data on cpu down Greg Kroah-Hartman
2013-05-17 21:49 ` [ 10/33] ext4: limit group search loop for non-extent files Greg Kroah-Hartman
2013-05-17 21:49 ` Greg Kroah-Hartman [this message]
2013-05-17 21:49 ` [ 12/33] mwifiex: clear is_suspended flag when interrupt is received early Greg Kroah-Hartman
2013-05-17 21:49 ` [ 13/33] mwifiex: fix setting of multicast filter Greg Kroah-Hartman
2013-05-17 21:49 ` [ 14/33] drm/mm: fix dump table BUG Greg Kroah-Hartman
2013-05-17 21:49 ` [ 15/33] tcp: force a dst refcount when prequeue packet Greg Kroah-Hartman
2013-05-17 21:50 ` [ 16/33] 3c509.c: call SET_NETDEV_DEV for all device types (ISA/ISAPnP/EISA) Greg Kroah-Hartman
2013-05-17 21:50 ` [ 17/33] net_sched: act_ipt forward compat with xtables Greg Kroah-Hartman
2013-05-17 21:50 ` [ 18/33] bridge: fix race with topology change timer Greg Kroah-Hartman
2013-05-17 21:50 ` [ 19/33] 3c59x: fix freeing nonexistent resource on driver unload Greg Kroah-Hartman
2013-05-17 21:50 ` [ 20/33] 3c59x: fix PCI resource management Greg Kroah-Hartman
2013-05-17 21:50 ` [ 21/33] if_cablemodem.h: Add parenthesis around ioctl macros Greg Kroah-Hartman
2013-05-17 21:50 ` [ 22/33] macvlan: fix passthru mode race between dev removal and rx path Greg Kroah-Hartman
2013-05-17 21:50 ` [ 23/33] ipv6: do not clear pinet6 field Greg Kroah-Hartman
2013-05-17 21:50 ` [ 24/33] xfrm6: release dev before returning error Greg Kroah-Hartman
2013-05-17 21:50 ` [ 25/33] pch_dma: Use GFP_ATOMIC because called from interrupt context Greg Kroah-Hartman
2013-05-17 21:50 ` [ 26/33] r8169: fix vlan tag read ordering Greg Kroah-Hartman
2013-05-17 21:50 ` [ 27/33] drbd: fix for deadlock when using automatic split-brain-recovery Greg Kroah-Hartman
2013-05-17 21:50 ` [ 28/33] drivers/rtc/rtc-pcf2123.c: fix error return code in pcf2123_probe() Greg Kroah-Hartman
2013-05-17 21:50 ` [ 29/33] ACPI / EC: Restart transaction even when the IBF flag set Greg Kroah-Hartman
2013-05-17 21:50 ` [ 30/33] drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow Greg Kroah-Hartman
2013-05-17 21:50 ` [ 31/33] ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex Greg Kroah-Hartman
2013-05-17 21:50 ` [ 32/33] drm/radeon: check incoming cliprects pointer Greg Kroah-Hartman
2013-05-17 21:50 ` [ 33/33] usermodehelper: check subprocess_info->path != NULL Greg Kroah-Hartman
2013-05-19 11:15 ` [ 00/33] 3.0.79-stable review Satoru Takeuchi
2013-05-19 17:07   ` Greg Kroah-Hartman
2013-05-19 17:09   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130517214918.065244208@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linville@tuxdriver.com \
    --cc=nbd@openwrt.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox