netdev - [PATCH] d80211: Fix __ieee80211_if

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 10 Jan 2007 01:19:14 -0500
From:	Michael Wu <flamingice@...rmilk.net>
To:	Jiri Benc <jbenc@...e.cz>
Cc:	John Linville <linville@...driver.com>, netdev@...r.kernel.org,
	Ulrich Kunitz <kune@...ne-taler.de>,
	Michael Buesch <mb@...sch.de>
Subject: [PATCH] d80211: Fix __ieee80211_if_del on live interfaces

d80211: Fix __ieee80211_if_del on live interfaces

ieee80211_if_reinit is called in __ieee80211_if_del, which clears the
contents of sdata->u. After that, unregister_netdevice is called. If the
interface is still up, unregister_netdevice will end up calling dev->stop,
and dev->stop expects the contents of sdata->u to be valid. Bad things
typically happen at this point.

This patch fixes that by setting dev->uninit to ieee80211_if_reinit and
eliminating the call to ieee80211_if_reinit in __ieee80211_if_del. This
allows ieee80211_if_reinit to be called at a safer time. It also allows
the removal of the call to ieee80211_if_shutdown in ieee80211_if_reinit
because ieee80211_if_reinit now will never be called while the interface
is up.

Signed-off-by: Michael Wu <flamingice@...rmilk.net>
---

 net/d80211/ieee80211.c       |    2 ++
 net/d80211/ieee80211_iface.c |    4 ----
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/d80211/ieee80211.c b/net/d80211/ieee80211.c
index 964fe45..2f1dce5 100644
--- a/net/d80211/ieee80211.c
+++ b/net/d80211/ieee80211.c
@@ -4324,6 +4324,7 @@ void ieee80211_if_setup(struct net_devic
 	dev->open = ieee80211_open;
 	dev->stop = ieee80211_stop;
 	dev->tx_queue_len = 0;
+	dev->uninit = ieee80211_if_reinit;
 	dev->destructor = ieee80211_if_free;
 }
 
@@ -4338,6 +4339,7 @@ void ieee80211_if_mgmt_setup(struct net_
 	dev->type = ARPHRD_IEEE80211_PRISM;
 	dev->hard_header_parse = header_parse_80211;
 	dev->tx_queue_len = 0;
+	dev->uninit = ieee80211_if_reinit;
 	dev->destructor = ieee80211_if_free;
 }
 
diff --git a/net/d80211/ieee80211_iface.c b/net/d80211/ieee80211_iface.c
index cac0dd5..3b2d259 100644
--- a/net/d80211/ieee80211_iface.c
+++ b/net/d80211/ieee80211_iface.c
@@ -234,9 +234,6 @@ void ieee80211_if_reinit(struct net_devi
 		sdata->keys[i] = NULL;
 	}
 
-	/* Shouldn't be necessary but won't hurt */
-	ieee80211_if_shutdown(dev);
-
 	switch (sdata->type) {
 	case IEEE80211_IF_TYPE_AP: {
 		/* Remove all virtual interfaces that use this BSS
@@ -311,7 +308,6 @@ void __ieee80211_if_del(struct ieee80211
 {
 	struct net_device *dev = sdata->dev;
 
-	ieee80211_if_reinit(dev);
 	list_del(&sdata->list);
 	ieee80211_sysfs_remove_netdevice(dev);
 	unregister_netdevice(dev);

Content of type "application/pgp-signature" skipped