提交 2b58b209 编写于 作者: J Jouni Malinen 提交者: John W. Linville

mac80211: Fix debugfs union misuse and pointer corruption

debugfs union in struct ieee80211_sub_if_data is misused by including a
common default_key dentry as a union member. This ends occupying the same
memory area with the first dentry in other union members (structures;
usually drop_unencrypted). Consequently, debugfs operations on
default_key symlinks and drop_unencrypted entry are using the same
dentry pointer even though they are supposed to be separate ones. This
can lead to removing entries incorrectly or potentially leaving
something behind since one of the dentry pointers gets lost.

Fix this by moving the default_key dentry to a new struct
(common_debugfs) that contains dentries (more to be added in future)
that are shared by all vif types. The debugfs union must only be used
for vif type-specific entries to avoid this type of pointer corruption.
Signed-off-by: NJouni Malinen <jouni.malinen@atheros.com>
Acked-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
上级 9a52028e
...@@ -265,7 +265,7 @@ void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata) ...@@ -265,7 +265,7 @@ void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata)
key = sdata->default_key; key = sdata->default_key;
if (key) { if (key) {
sprintf(buf, "../keys/%d", key->debugfs.cnt); sprintf(buf, "../keys/%d", key->debugfs.cnt);
sdata->debugfs.default_key = sdata->common_debugfs.default_key =
debugfs_create_symlink("default_key", debugfs_create_symlink("default_key",
sdata->debugfsdir, buf); sdata->debugfsdir, buf);
} else } else
...@@ -277,8 +277,8 @@ void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata) ...@@ -277,8 +277,8 @@ void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata)
if (!sdata) if (!sdata)
return; return;
debugfs_remove(sdata->debugfs.default_key); debugfs_remove(sdata->common_debugfs.default_key);
sdata->debugfs.default_key = NULL; sdata->common_debugfs.default_key = NULL;
} }
void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key, void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
......
...@@ -496,8 +496,10 @@ struct ieee80211_sub_if_data { ...@@ -496,8 +496,10 @@ struct ieee80211_sub_if_data {
struct { struct {
struct dentry *mode; struct dentry *mode;
} monitor; } monitor;
struct dentry *default_key;
} debugfs; } debugfs;
struct {
struct dentry *default_key;
} common_debugfs;
#ifdef CONFIG_MAC80211_MESH #ifdef CONFIG_MAC80211_MESH
struct dentry *mesh_stats_dir; struct dentry *mesh_stats_dir;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册