mac80211: fix two remote exploits

[safe/jmp/linux-2.6] / net / mac80211 / util.c

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8502936..e6c08da 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -339,7 +339,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
        if (WARN_ON(!info->control.vif)) {
-               kfree(skb);
+               kfree_skb(skb);
                return;
        }
 
@@ -367,7 +367,7 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                if (WARN_ON(!info->control.vif)) {
-                       kfree(skb);
+                       kfree_skb(skb);
                        continue;
                }
 
@@ -511,6 +511,46 @@ void ieee80211_iterate_active_interfaces_atomic(
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 
+/*
+ * Nothing should have been stuffed into the workqueue during
+ * the suspend->resume cycle. If this WARN is seen then there
+ * is a bug with either the driver suspend or something in
+ * mac80211 stuffing into the workqueue which we haven't yet
+ * cleared during mac80211's suspend cycle.
+ */
+static bool ieee80211_can_queue_work(struct ieee80211_local *local)
+{
+       if (WARN(local->suspended && !local->resuming,
+                "queueing ieee80211 work while going to suspend\n"))
+               return false;
+
+       return true;
+}
+
+void ieee80211_queue_work(struct ieee80211_hw *hw, struct work_struct *work)
+{
+       struct ieee80211_local *local = hw_to_local(hw);
+
+       if (!ieee80211_can_queue_work(local))
+               return;
+
+       queue_work(local->workqueue, work);
+}
+EXPORT_SYMBOL(ieee80211_queue_work);
+
+void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
+                                 struct delayed_work *dwork,
+                                 unsigned long delay)
+{
+       struct ieee80211_local *local = hw_to_local(hw);
+
+       if (!ieee80211_can_queue_work(local))
+               return;
+
+       queue_delayed_work(local->workqueue, dwork, delay);
+}
+EXPORT_SYMBOL(ieee80211_queue_delayed_work);
+
 void ieee802_11_parse_elems(u8 *start, size_t len,
                            struct ieee802_11_elems *elems)
 {
@@ -967,6 +1007,16 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
        return supp_rates;
 }
 
+void ieee80211_stop_device(struct ieee80211_local *local)
+{
+       ieee80211_led_radio(local, false);
+
+       cancel_work_sync(&local->reconfig_filter);
+       drv_stop(local);
+
+       flush_workqueue(local->workqueue);
+}
+
 int ieee80211_reconfig(struct ieee80211_local *local)
 {
        struct ieee80211_hw *hw = &local->hw;
@@ -975,13 +1025,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        struct sta_info *sta;
        unsigned long flags;
        int res;
-       bool from_suspend = local->suspended;
 
-       /*
-        * We're going to start the hardware, at that point
-        * we are no longer suspended and can RX frames.
-        */
-       local->suspended = false;
+       if (local->suspended)
+               local->resuming = true;
 
        /* restart hardware */
        if (local->open_count) {
@@ -1036,9 +1082,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        /* reconfigure hardware */
        ieee80211_hw_config(local, ~0);
 
-       spin_lock_bh(&local->filter_lock);
        ieee80211_configure_filter(local);
-       spin_unlock_bh(&local->filter_lock);
 
        /* Finally also reconfigure all the BSS information */
        list_for_each_entry(sdata, &local->interfaces, list) {
@@ -1081,11 +1125,14 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         * If this is for hw restart things are still running.
         * We may want to change that later, however.
         */
-       if (!from_suspend)
+       if (!local->suspended)
                return 0;
 
 #ifdef CONFIG_PM
+       /* first set suspended false, then resuming */
        local->suspended = false;
+       mb();
+       local->resuming = false;
 
        list_for_each_entry(sdata, &local->interfaces, list) {
                switch(sdata->vif.type) {
@@ -1114,3 +1161,4 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 #endif
        return 0;
 }
+