net: ipmr/ip6mr: fix potential out-of-bounds vif_table access

[safe/jmp/linux-2.6] / net / mac80211 / key.c

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 19b480d..8160d9c 100644 (file)
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -16,6 +16,7 @@
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "debugfs_key.h"
 #include "aes_ccm.h"
 #include "aes_cmac.h"
@@ -66,6 +67,8 @@ static DECLARE_WORK(todo_work, key_todo);
  *
  * @key: key to add to do item for
  * @flag: todo flag(s)
+ *
+ * Must be called with IRQs or softirqs disabled.
  */
 static void add_todo(struct ieee80211_key *key, u32 flag)
 {
@@ -136,13 +139,12 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                                     struct ieee80211_sub_if_data,
                                     u.ap);
 
-       ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
-                                      &sdata->vif, sta, &key->conf);
+       ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
 
        if (!ret) {
-               spin_lock(&todo_lock);
+               spin_lock_bh(&todo_lock);
                key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-               spin_unlock(&todo_lock);
+               spin_unlock_bh(&todo_lock);
        }
 
        if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
@@ -164,12 +166,12 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
        if (!key || !key->local->ops->set_key)
                return;
 
-       spin_lock(&todo_lock);
+       spin_lock_bh(&todo_lock);
        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
-               spin_unlock(&todo_lock);
+               spin_unlock_bh(&todo_lock);
                return;
        }
-       spin_unlock(&todo_lock);
+       spin_unlock_bh(&todo_lock);
 
        sta = get_sta_for_key(key);
        sdata = key->sdata;
@@ -179,8 +181,8 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                                     struct ieee80211_sub_if_data,
                                     u.ap);
 
-       ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
-                                      &sdata->vif, sta, &key->conf);
+       ret = drv_set_key(key->local, DISABLE_KEY, sdata,
+                         sta, &key->conf);
 
        if (ret)
                printk(KERN_ERR "mac80211-%s: failed to remove key "
@@ -188,9 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                       wiphy_name(key->local->hw.wiphy),
                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
-       spin_lock(&todo_lock);
+       spin_lock_bh(&todo_lock);
        key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-       spin_unlock(&todo_lock);
+       spin_unlock_bh(&todo_lock);
 }
 
 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
@@ -290,9 +292,11 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
 struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                          int idx,
                                          size_t key_len,
-                                         const u8 *key_data)
+                                         const u8 *key_data,
+                                         size_t seq_len, const u8 *seq)
 {
        struct ieee80211_key *key;
+       int i, j;
 
        BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
 
@@ -318,14 +322,31 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
        case ALG_TKIP:
                key->conf.iv_len = TKIP_IV_LEN;
                key->conf.icv_len = TKIP_ICV_LEN;
+               if (seq) {
+                       for (i = 0; i < NUM_RX_DATA_QUEUES; i++) {
+                               key->u.tkip.rx[i].iv32 =
+                                       get_unaligned_le32(&seq[2]);
+                               key->u.tkip.rx[i].iv16 =
+                                       get_unaligned_le16(seq);
+                       }
+               }
                break;
        case ALG_CCMP:
                key->conf.iv_len = CCMP_HDR_LEN;
                key->conf.icv_len = CCMP_MIC_LEN;
+               if (seq) {
+                       for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
+                               for (j = 0; j < CCMP_PN_LEN; j++)
+                                       key->u.ccmp.rx_pn[i][j] =
+                                               seq[CCMP_PN_LEN - j - 1];
+               }
                break;
        case ALG_AES_CMAC:
                key->conf.iv_len = 0;
                key->conf.icv_len = sizeof(struct ieee80211_mmie);
+               if (seq)
+                       for (j = 0; j < 6; j++)
+                               key->u.aes_cmac.rx_pn[j] = seq[6 - j - 1];
                break;
        }
        memcpy(key->conf.key, key_data, key_len);
@@ -400,7 +421,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                         */
 
                        /* same here, the AP could be using QoS */
-                       ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
+                       ap = sta_info_get(key->sdata, key->sdata->u.mgd.bssid);
                        if (ap) {
                                if (test_sta_flags(ap, WLAN_STA_WME))
                                        key->conf.flags |=
@@ -418,14 +439,14 @@ void ieee80211_key_link(struct ieee80211_key *key,
 
        __ieee80211_key_replace(sdata, sta, old_key, key);
 
-       spin_unlock_irqrestore(&sdata->local->key_lock, flags);
-
        /* free old key later */
        add_todo(old_key, KEY_FLAG_TODO_DELETE);
 
        add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
-       if (netif_running(sdata->dev))
+       if (ieee80211_sdata_running(sdata))
                add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
+
+       spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
 
 static void __ieee80211_key_free(struct ieee80211_key *key)
@@ -488,7 +509,7 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
        ASSERT_RTNL();
 
-       if (WARN_ON(!netif_running(sdata->dev)))
+       if (WARN_ON(!ieee80211_sdata_running(sdata)))
                return;
 
        ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
@@ -528,7 +549,7 @@ static void __ieee80211_key_todo(void)
         */
        synchronize_rcu();
 
-       spin_lock(&todo_lock);
+       spin_lock_bh(&todo_lock);
        while (!list_empty(&todo_list)) {
                key = list_first_entry(&todo_list, struct ieee80211_key, todo);
                list_del_init(&key->todo);
@@ -539,7 +560,7 @@ static void __ieee80211_key_todo(void)
                                          KEY_FLAG_TODO_HWACCEL_REMOVE |
                                          KEY_FLAG_TODO_DELETE);
                key->flags &= ~todoflags;
-               spin_unlock(&todo_lock);
+               spin_unlock_bh(&todo_lock);
 
                work_done = false;
 
@@ -572,9 +593,9 @@ static void __ieee80211_key_todo(void)
 
                WARN_ON(!work_done);
 
-               spin_lock(&todo_lock);
+               spin_lock_bh(&todo_lock);
        }
-       spin_unlock(&todo_lock);
+       spin_unlock_bh(&todo_lock);
 }
 
 void ieee80211_key_todo(void)