tmp_suning_uos_patched/net
Michal Kazior ab499db80f mac80211: prevent possible crypto tx tailroom corruption
There was a possible race between
ieee80211_reconfig() and
ieee80211_delayed_tailroom_dec(). This could
result in inability to transmit data if driver
crashed during roaming or rekeying and subsequent
skbs with insufficient tailroom appeared.

This race was probably never seen in the wild
because a device driver would have to crash AND
recover within 0.5s which is very unlikely.

I was able to prove this race exists after
changing the delay to 10s locally and crashing
ath10k via debugfs immediately after GTK
rekeying. In case of ath10k the counter went below
0. This was harmless but other drivers which
actually require tailroom (e.g. for WEP ICV or
MMIC) could end up with the counter at 0 instead
of >0 and introduce insufficient skb tailroom
failures because mac80211 would not resize skbs
appropriately anymore.

Fixes: 8d1f7ecd2a ("mac80211: defer tailroom counter manipulation when roaming")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-05-29 13:04:46 +02:00
..
6lowpan
9p net/9p: remove (now-)unused helpers 2015-04-11 22:28:29 -04:00
802
8021q vlan: implement ndo_get_iflink 2015-04-02 14:05:00 -04:00
appletalk
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-04-15 09:00:47 -07:00
ax25
batman-adv dev: introduce dev_get_iflink() 2015-04-02 14:04:59 -04:00
bluetooth Bluetooth: Read LE remote features during connection establishment 2015-04-09 08:36:54 +03:00
bridge netfilter: nf_tables: switch registers to 32 bit addressing 2015-04-13 17:17:29 +02:00
caif Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-03-20 18:51:09 -04:00
can can: introduce new raw socket option to join the given CAN filters 2015-04-01 11:28:22 +02:00
ceph Revert "libceph: use memalloc flags for net IO" 2015-04-07 19:08:35 +03:00
core net: remove unused 'dev' argument from netif_needs_gso() 2015-04-17 13:29:41 -04:00
dcb
dccp tcp/dccp: get rid of central timewait timer 2015-04-13 16:40:05 -04:00
decnet netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
dns_resolver
dsa net: dsa: use DEVICE_ATTR_RW to declare temp1_max 2015-04-17 15:58:37 -04:00
ethernet
hsr
ieee802154 ieee802154: don't export static symbol 2015-03-14 17:11:31 +01:00
ipv4 inet_diag: fix access to tcp cc information 2015-04-17 13:28:31 -04:00
ipv6 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2015-04-14 18:51:19 -04:00
ipx
irda Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-03-09 23:38:02 -04:00
iucv Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-04-02 16:16:53 -04:00
key xfrm: simplify xfrm_address_t use 2015-03-31 13:58:35 -04:00
l2tp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-04-06 22:34:15 -04:00
lapb
llc
mac80211 mac80211: prevent possible crypto tx tailroom corruption 2015-05-29 13:04:46 +02:00
mac802154 mac802154: cleanup concurrent check 2015-03-27 19:18:50 +01:00
mpls mpls: In mpls_egress verify the packet length. 2015-03-12 23:05:04 -04:00
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2015-04-14 18:51:19 -04:00
netlabel netlink: implement nla_put_in_addr and nla_put_in6_addr 2015-03-31 13:58:35 -04:00
netlink rhashtable: provide len to obj_hashfn 2015-03-25 17:18:33 +01:00
netrom
nfc nfc: Fix portid type in urelease_work 2015-04-13 16:35:16 -04:00
openvswitch Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-04-15 09:00:47 -07:00
packet af_packet: pass checksum validation status to the user 2015-03-23 22:01:28 -04:00
phonet
rds Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-04-14 15:44:14 -04:00
rfkill net: rfkill: Switch to PM ops 2015-05-20 15:00:00 +02:00
rose
rxrpc new helper: msg_data_left() 2015-04-11 15:53:35 -04:00
sched act_mirred: Fix bogus header when redirecting from VLAN 2015-04-17 13:29:28 -04:00
sctp sctp: avoid to repeatedly declare external variables 2015-03-25 11:40:16 -04:00
sunrpc lib/string_helpers.c: change semantics of string_escape_mem 2015-04-15 16:35:24 -07:00
switchdev switchdev: fix stp update API to work with layered netdevices 2015-03-23 16:44:56 -04:00
tipc udp_tunnel: Pass UDP socket down through udp_tunnel{, 6}_xmit_skb(). 2015-04-07 15:29:08 -04:00
unix
vmw_vsock
wimax
wireless cfg80211: properly send NL80211_ATTR_DISCONNECTED_BY_AP in disconnect 2015-05-26 15:21:27 +02:00
x25
xfrm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-04-14 15:44:14 -04:00
compat.c net: switch importing msghdr from userland to {compat_,}import_iovec() 2015-04-09 00:02:26 -04:00
Kconfig
Makefile
socket.c make new_sync_{read,write}() static 2015-04-11 22:29:40 -04:00
sysctl_net.c