Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 45854360 authored by Johannes Berg's avatar Johannes Berg Committed by Emmanuel Grumbach
Browse files

iwlwifi: mvm: protect RCU dereference in iwl_mvm_get_key_sta_id 



Properly protect the RCU dereference in iwl_mvm_get_key_sta_id() when
coming from iwl_mvm_update_tkip_key() which cannot hold the mvm->mutex
by moving the call into the RCU critical section.
Modify the check to use rcu_dereference_check() to permit this.

Fixes: 9513c5e1 ("iwlwifi: mvm: Avoid dereferencing sta if it was already flushed")
Reported-by: default avatarLaura Abbott <labbott@redhat.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
parent 628a2918

drivers/net/wireless/iwlwifi/mvm/sta.c

+9 −6
Original line number Diff line number Diff line
@@ -1222,7 +1222,7 @@ static u8 iwl_mvm_get_key_sta_id(struct iwl_mvm *mvm, 
	    mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {

		u8 sta_id = mvmvif->ap_sta_id;



		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],

		sta = rcu_dereference_check(mvm->fw_id_to_mac_id[sta_id],

					    lockdep_is_held(&mvm->mutex));

		/*

		 * It is possible that the 'sta' parameter is NULL,
@@ -1590,14 +1590,15 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm, 
			     u16 *phase1key)

{

	struct iwl_mvm_sta *mvm_sta;

	u8 sta_id = iwl_mvm_get_key_sta_id(mvm, vif, sta);

	u8 sta_id;

	bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);



	if (WARN_ON_ONCE(sta_id == IWL_MVM_STATION_COUNT))

		return;



	rcu_read_lock();



	sta_id = iwl_mvm_get_key_sta_id(mvm, vif, sta);

	if (WARN_ON_ONCE(sta_id == IWL_MVM_STATION_COUNT))

		goto unlock;



	if (!sta) {

		sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);

		if (WARN_ON(IS_ERR_OR_NULL(sta))) {
@@ -1609,6 +1610,8 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm, 
	mvm_sta = iwl_mvm_sta_from_mac80211(sta);

	iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,

			     iv32, phase1key, CMD_ASYNC, keyconf->hw_key_idx);



 unlock:

	rcu_read_unlock();

}