From 9b0b4d8ae82cadd059d01ab93babcaa5e2054b93 Mon Sep 17 00:00:00 2001 From: Michael Buesch Date: Fri, 7 Apr 2006 01:42:55 +0200 Subject: [PATCH] softmac: fix spinlock recursion on reassoc This fixes a spinlock recursion on receiving a reassoc request. On reassoc, the softmac calls back into the driver. This results in a driver lock recursion. This schedules the assoc workqueue, instead of calling it directly. Probably, we should defer the _whole_ management frame processing to a tasklet or workqueue, because it does several callbacks into the driver. That is dangerous. This fix should go into linus's tree, before 2.6.17 is released, because it is remote exploitable (DoS by crash). Signed-off-by: John W. Linville --- net/ieee80211/softmac/ieee80211softmac_assoc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'net/ieee80211/softmac/ieee80211softmac_assoc.c') diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c index be61de78dfa4..cb9fca86c26b 100644 --- a/net/ieee80211/softmac/ieee80211softmac_assoc.c +++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c @@ -391,6 +391,7 @@ ieee80211softmac_handle_reassoc_req(struct net_device * dev, dprintkl(KERN_INFO PFX "reassoc request from unknown network\n"); return 0; } - ieee80211softmac_assoc(mac, network); + schedule_work(&mac->associnfo.work); + return 0; } -- cgit v1.2.3 From feeeaa87e8e6702f57ed3be7904ffd87cc044b82 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Thu, 13 Apr 2006 02:42:42 +0200 Subject: [PATCH] softmac: fix event sending Softmac is sending custom events to userspace already, but it should _really_ be sending the right WEXT events instead. This patch fixes that. Signed-off-by: Dan Williams Signed-off-by: Johannes Berg Signed-off-by: John W. Linville --- include/net/ieee80211softmac.h | 3 ++- net/ieee80211/softmac/ieee80211softmac_assoc.c | 2 ++ net/ieee80211/softmac/ieee80211softmac_event.c | 34 ++++++++++++++++++++++---- 3 files changed, 33 insertions(+), 6 deletions(-) (limited to 'net/ieee80211/softmac/ieee80211softmac_assoc.c') diff --git a/include/net/ieee80211softmac.h b/include/net/ieee80211softmac.h index b971d8c82bdd..6b3693f05ca0 100644 --- a/include/net/ieee80211softmac.h +++ b/include/net/ieee80211softmac.h @@ -267,8 +267,9 @@ extern void ieee80211softmac_stop(struct net_device *dev); #define IEEE80211SOFTMAC_EVENT_AUTH_FAILED 5 #define IEEE80211SOFTMAC_EVENT_AUTH_TIMEOUT 6 #define IEEE80211SOFTMAC_EVENT_ASSOCIATE_NET_NOT_FOUND 7 +#define IEEE80211SOFTMAC_EVENT_DISASSOCIATED 8 /* keep this updated! */ -#define IEEE80211SOFTMAC_EVENT_LAST 7 +#define IEEE80211SOFTMAC_EVENT_LAST 8 /* * If you want to be notified of certain events, you can call * ieee80211softmac_notify[_atomic] with diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c index cb9fca86c26b..4498023841dc 100644 --- a/net/ieee80211/softmac/ieee80211softmac_assoc.c +++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c @@ -101,6 +101,7 @@ ieee80211softmac_disassoc(struct ieee80211softmac_device *mac, u16 reason) /* Do NOT clear bssvalid as that will break ieee80211softmac_assoc_work! */ mac->associated = 0; mac->associnfo.associating = 0; + ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL); spin_unlock_irqrestore(&mac->lock, flags); } @@ -373,6 +374,7 @@ ieee80211softmac_handle_disassoc(struct net_device * dev, spin_lock_irqsave(&mac->lock, flags); mac->associnfo.bssvalid = 0; mac->associated = 0; + ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL); schedule_work(&mac->associnfo.work); spin_unlock_irqrestore(&mac->lock, flags); diff --git a/net/ieee80211/softmac/ieee80211softmac_event.c b/net/ieee80211/softmac/ieee80211softmac_event.c index 0a52bbda1e4c..5bdd5edd432c 100644 --- a/net/ieee80211/softmac/ieee80211softmac_event.c +++ b/net/ieee80211/softmac/ieee80211softmac_event.c @@ -67,6 +67,7 @@ static char *event_descriptions[IEEE80211SOFTMAC_EVENT_LAST+1] = { "authenticating failed", "authenticating timed out", "associating failed because no suitable network was found", + "disassociated", }; @@ -128,13 +129,36 @@ void ieee80211softmac_call_events_locked(struct ieee80211softmac_device *mac, int event, void *event_ctx) { struct ieee80211softmac_event *eventptr, *tmp; - union iwreq_data wrqu; - char *msg; + struct ieee80211softmac_network *network; if (event >= 0) { - msg = event_descriptions[event]; - wrqu.data.length = strlen(msg); - wireless_send_event(mac->dev, IWEVCUSTOM, &wrqu, msg); + union iwreq_data wrqu; + int we_event; + char *msg = NULL; + + switch(event) { + case IEEE80211SOFTMAC_EVENT_ASSOCIATED: + network = (struct ieee80211softmac_network *)event_ctx; + wrqu.data.length = 0; + wrqu.data.flags = 0; + memcpy(wrqu.ap_addr.sa_data, &network->bssid[0], ETH_ALEN); + wrqu.ap_addr.sa_family = ARPHRD_ETHER; + we_event = SIOCGIWAP; + break; + case IEEE80211SOFTMAC_EVENT_DISASSOCIATED: + wrqu.data.length = 0; + wrqu.data.flags = 0; + memset(&wrqu, '\0', sizeof (union iwreq_data)); + wrqu.ap_addr.sa_family = ARPHRD_ETHER; + we_event = SIOCGIWAP; + break; + default: + msg = event_descriptions[event]; + wrqu.data.length = strlen(msg); + we_event = IWEVCUSTOM; + break; + } + wireless_send_event(mac->dev, we_event, &wrqu, msg); } if (!list_empty(&mac->events)) -- cgit v1.2.3