kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/mac80211
History
Michal Kazior 0e05e75326 mac80211: prevent possible crypto tx tailroom corruption 
[ Upstream commit ab499db80f ]

There was a possible race between
ieee80211_reconfig() and
ieee80211_delayed_tailroom_dec(). This could
result in inability to transmit data if driver
crashed during roaming or rekeying and subsequent
skbs with insufficient tailroom appeared.

This race was probably never seen in the wild
because a device driver would have to crash AND
recover within 0.5s which is very unlikely.

I was able to prove this race exists after
changing the delay to 10s locally and crashing
ath10k via debugfs immediately after GTK
rekeying. In case of ath10k the counter went below
0. This was harmless but other drivers which
actually require tailroom (e.g. for WEP ICV or
MMIC) could end up with the counter at 0 instead
of >0 and introduce insufficient skb tailroom
failures because mac80211 would not resize skbs
appropriately anymore.

Fixes: 8d1f7ecd2a ("mac80211: defer tailroom counter manipulation when roaming")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2015-08-04 14:37:08 -04:00
..
aes_ccm.c mac80211: Fix regression that triggers a kernel BUG with CCMP 2014-11-06 12:42:22 +01:00
aes_ccm.h mac80211: port CCMP to cryptoapi's CCM driver 2013-10-11 15:38:20 +02:00
aes_cmac.c mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
aes_cmac.h mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
agg-rx.c mac80211: fix RX A-MPDU session reorder timer deletion 2015-04-23 14:58:29 -04:00
agg-tx.c mac80211: introduce refcount for queue_stop_reasons 2014-06-23 14:22:25 +02:00
cfg.c mac80211: return the vif's chandef in ieee80211_cfg_get_channel() 2014-10-09 11:01:58 +02:00
cfg.h mac80211: make cfg80211 ops and privid const 2014-02-04 21:48:21 +01:00
chan.c mac80211: copy chandef from AP vif to VLANs 2015-01-08 10:30:23 -08:00
debug.h mac80211: process the CSA frame for mesh accordingly 2013-10-28 15:05:28 +01:00
debugfs.c mac80211: replace SMPS hw flags with wiphy feature bits 2014-09-11 13:37:02 +02:00
debugfs.h mac80211: fix some missing includes 2014-04-09 14:49:43 +02:00
debugfs_key.c mac80211: move sdata debugfs dir to vif 2013-03-18 20:10:04 +01:00
debugfs_key.h mac80211: support separate default keys 2010-12-13 15:23:29 -05:00
debugfs_netdev.c mac80211: replace SMPS hw flags with wiphy feature bits 2014-09-11 13:37:02 +02:00
debugfs_netdev.h mac80211: fix some missing includes 2014-04-09 14:49:43 +02:00
debugfs_sta.c This time, I have some rate minstrel improvements, support for a very 2014-09-15 14:51:23 -04:00
debugfs_sta.h mac80211: RCU-ify STA info structure access 2008-03-06 15:30:46 -05:00
driver-ops.h mac80211: extend set_coverage_class signature 2014-09-05 13:54:07 +02:00
ethtool.c cfg80211: make ethtool the driver's responsibility 2014-06-23 11:05:33 +02:00
event.c cfg80211: use proper allocation flags 2009-07-10 15:01:49 -04:00
ht.c mac80211: set Rx highest rate in ht_cap 2014-07-21 12:14:04 +02:00
ibss.c mac80211: use secondary channel offset IE also beacons during CSA 2014-10-29 16:37:45 +01:00
ieee80211_i.h mac80211: don't use napi_gro_receive() outside NAPI context 2015-06-10 13:42:30 -04:00
iface.c mac80211: copy chandef from AP vif to VLANs 2015-01-08 10:30:23 -08:00
Kconfig mac80211: remove PID rate control 2014-06-23 11:05:23 +02:00
key.c Revert "mac80211: Fix accounting of the tailroom-needed counter" 2015-01-16 06:59:56 -08:00
key.h mac80211: free all AP/VLAN keys at once 2013-12-16 11:29:48 +01:00
led.c mac80211: use oneshot blink API for LED triggers 2013-08-01 10:48:49 +02:00
led.h mac80211: use oneshot blink API for LED triggers 2013-08-01 10:48:49 +02:00
main.c mac80211: prevent possible crypto tx tailroom corruption 2015-08-04 14:37:08 -04:00
Makefile cfg80211: make ethtool the driver's responsibility 2014-06-23 11:05:33 +02:00
mesh.c mac80211: use secondary channel offset IE also beacons during CSA 2014-10-29 16:37:45 +01:00
mesh.h mac80211: use put_unaligned_le in mesh when necessary 2013-11-25 20:51:55 +01:00
mesh_hwmp.c mac80211: remove unnecessary break after return 2014-07-15 16:27:00 -07:00
mesh_pathtbl.c mac80211: Replace rcu_dereference() with rcu_access_pointer() 2014-08-27 12:14:10 +02:00
mesh_plink.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2014-09-08 11:14:56 -04:00
mesh_ps.c mac80211: clear sequence/fragment number in QoS-null frames 2014-03-05 15:49:54 +01:00
mesh_sync.c mac80211: remove BUG_ON usage 2014-04-29 17:59:27 +02:00
michael.c mac80211: remove ieee80211_get_hdr_info 2008-07-08 14:16:01 -04:00
michael.h mac80211: fix some missing includes 2014-04-09 14:49:43 +02:00
mlme.c mac80211: avoid using uninitialized stack data 2015-01-08 10:30:23 -08:00
offchannel.c mac80211: introduce refcount for queue_stop_reasons 2014-06-23 14:22:25 +02:00
pm.c mac80211: only roll back station states for WDS when suspending 2015-02-05 22:36:05 -08:00
rate.c mac80211: fix typo in starting baserate for rts_cts_rate_idx 2014-10-14 11:16:16 +02:00
rate.h mac80211: remove PID rate control 2014-06-23 11:05:23 +02:00
rc80211_minstrel.c mac80211: Unify rate statistic variables between Minstrel & Minstrel_HT 2014-09-11 12:08:31 +02:00
rc80211_minstrel.h mac80211: Unify rate statistic variables between Minstrel & Minstrel_HT 2014-09-11 12:08:31 +02:00
rc80211_minstrel_debugfs.c mac80211: minstrels: fix buffer overflow in HT debugfs rc_stats 2014-10-20 16:37:01 +02:00
rc80211_minstrel_ht.c mac80211: minstrel_ht: fix a crash in rate sorting 2014-11-18 22:39:16 +01:00
rc80211_minstrel_ht.h mac80211: improve minstrel_ht rate sorting by throughput & probability 2014-09-11 12:10:14 +02:00
rc80211_minstrel_ht_debugfs.c mac80211: minstrels: fix buffer overflow in HT debugfs rc_stats 2014-10-20 16:37:01 +02:00
rx.c mac80211: don't use napi_gro_receive() outside NAPI context 2015-06-10 13:42:30 -04:00
scan.c mac80211: add Intel Mobile Communications copyright 2014-09-05 13:52:06 +02:00
spectmgmt.c mac80211: use secondary channel offset IE also beacons during CSA 2014-10-29 16:37:45 +01:00
sta_info.c Merge tag 'master-2014-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next 2014-09-26 15:39:24 -04:00
sta_info.h mac80211: fix RX A-MPDU session reorder timer deletion 2015-04-23 14:58:29 -04:00
status.c mac80211: add TDLS connection timeout 2014-09-11 12:18:47 +02:00
tdls.c mac80211: set network header in TDLS frames 2014-09-11 12:25:22 +02:00
tkip.c mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
tkip.h mac80211: fix TKIP races, make API easier to use 2011-07-08 11:11:19 -04:00
trace.c mac80211: trace debug messages 2012-06-24 11:33:18 +02:00
trace.h mac80211: extend set_coverage_class signature 2014-09-05 13:54:07 +02:00
tx.c mac80211: Send EAPOL frames at lowest rate 2015-03-14 15:37:25 -04:00
util.c mac80211: count interfaces correctly for combination checks 2015-04-16 20:11:38 -04:00
vht.c mac80211: disable VHT for TDLS 2014-07-21 12:14:04 +02:00
wep.c mac80211: move WEP tailroom size check 2015-06-10 13:42:29 -04:00
wep.h mac80211: move RX WEP weak IV counting 2012-03-13 14:54:16 -04:00
wme.c mac80211: add Intel Mobile Communications copyright 2014-09-05 13:52:06 +02:00
wme.h mac80211: save wmm_acm per sdata 2012-06-20 17:35:22 +02:00
wpa.c mac80211: annotate MMIC head/tailroom warning 2014-09-08 11:22:42 +02:00
wpa.h mac80211: add generic cipher scheme support 2013-11-25 20:50:52 +01:00