package/mac80211/patches/320-mac80211_fix_key_del_race.patch

   1 From: Johannes Berg <johannes.berg@intel.com>
   2
   3 commit ad0e2b5a00dbec303e4682b403bb6703d11dcdb2
   4 Author: Johannes Berg <johannes.berg@intel.com>
   5 Date:   Tue Jun 1 10:19:19 2010 +0200
   6
   7     mac80211: simplify key locking
   8
   9 removed the synchronization against RCU and thus
  10 opened a race window where we can use a key for
  11 TX while it is already freed. Put a synchronisation
  12 into the right place to close that window.
  13
  14 Reported-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
  15 Cc: stable@kernel.org [2.6.36+]
  16 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  17
  18 --- a/net/mac80211/key.c
  19 +++ b/net/mac80211/key.c
  20 @@ -382,6 +382,12 @@ static void __ieee80211_key_destroy(stru
  21         if (!key)
  22                 return;
  23
  24 +       /*
  25 +        * Synchronize so the TX path can no longer be using
  26 +        * this key before we free/remove it.
  27 +        */
  28 +       synchronize_rcu();
  29 +
  30         if (key->local)
  31                 ieee80211_key_disable_hw_accel(key);
  32