mac80211: fix two remote exploits

[safe/jmp/linux-2.6] / net / mac80211 / util.c

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index e55d57f..e6c08da 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -339,7 +339,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
        if (WARN_ON(!info->control.vif)) {
-               kfree(skb);
+               kfree_skb(skb);
                return;
        }
 
@@ -367,7 +367,7 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                if (WARN_ON(!info->control.vif)) {
-                       kfree(skb);
+                       kfree_skb(skb);
                        continue;
                }
 
@@ -520,9 +520,9 @@ EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
  */
 static bool ieee80211_can_queue_work(struct ieee80211_local *local)
 {
-        if (WARN(local->suspended, "queueing ieee80211 work while "
-                "going to suspend\n"))
-                return false;
+       if (WARN(local->suspended && !local->resuming,
+                "queueing ieee80211 work while going to suspend\n"))
+               return false;
 
        return true;
 }
@@ -1007,6 +1007,16 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
        return supp_rates;
 }
 
+void ieee80211_stop_device(struct ieee80211_local *local)
+{
+       ieee80211_led_radio(local, false);
+
+       cancel_work_sync(&local->reconfig_filter);
+       drv_stop(local);
+
+       flush_workqueue(local->workqueue);
+}
+
 int ieee80211_reconfig(struct ieee80211_local *local)
 {
        struct ieee80211_hw *hw = &local->hw;
@@ -1015,13 +1025,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        struct sta_info *sta;
        unsigned long flags;
        int res;
-       bool from_suspend = local->suspended;
 
-       /*
-        * We're going to start the hardware, at that point
-        * we are no longer suspended and can RX frames.
-        */
-       local->suspended = false;
+       if (local->suspended)
+               local->resuming = true;
 
        /* restart hardware */
        if (local->open_count) {
@@ -1076,9 +1082,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        /* reconfigure hardware */
        ieee80211_hw_config(local, ~0);
 
-       spin_lock_bh(&local->filter_lock);
        ieee80211_configure_filter(local);
-       spin_unlock_bh(&local->filter_lock);
 
        /* Finally also reconfigure all the BSS information */
        list_for_each_entry(sdata, &local->interfaces, list) {
@@ -1121,11 +1125,14 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         * If this is for hw restart things are still running.
         * We may want to change that later, however.
         */
-       if (!from_suspend)
+       if (!local->suspended)
                return 0;
 
 #ifdef CONFIG_PM
+       /* first set suspended false, then resuming */
        local->suspended = false;
+       mb();
+       local->resuming = false;
 
        list_for_each_entry(sdata, &local->interfaces, list) {
                switch(sdata->vif.type) {