mac80211: fix a race condition during key deletion
[openwrt/svn-archive/archive.git] / package / mac80211 / patches / 320-mac80211_fix_key_del_race.patch
1 From: Johannes Berg <johannes.berg@intel.com>
2
3 commit ad0e2b5a00dbec303e4682b403bb6703d11dcdb2
4 Author: Johannes Berg <johannes.berg@intel.com>
5 Date: Tue Jun 1 10:19:19 2010 +0200
6
7 mac80211: simplify key locking
8
9 removed the synchronization against RCU and thus
10 opened a race window where we can use a key for
11 TX while it is already freed. Put a synchronisation
12 into the right place to close that window.
13
14 Reported-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
15 Cc: stable@kernel.org [2.6.36+]
16 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
17
18 --- a/net/mac80211/key.c
19 +++ b/net/mac80211/key.c
20 @@ -382,6 +382,12 @@ static void __ieee80211_key_destroy(stru
21 if (!key)
22 return;
23
24 + /*
25 + * Synchronize so the TX path can no longer be using
26 + * this key before we free/remove it.
27 + */
28 + synchronize_rcu();
29 +
30 if (key->local)
31 ieee80211_key_disable_hw_accel(key);
32