summaryrefslogtreecommitdiffstats
path: root/net/wireless
diff options
context:
space:
mode:
authorLuis R. Rodriguez <lrodriguez@atheros.com>2009-05-13 17:04:41 -0400
committerJohn W. Linville <linville@tuxdriver.com>2009-05-20 14:46:32 -0400
commit61405e97788b1bc4e7c5be5b4ec04a73fc11bac2 (patch)
tree468b4283c9b7b42ccd3423ab1e3ed25cb4dc16a5 /net/wireless
parentd0e18f833d23afefb6751a21d14a2cd71d2d4d66 (diff)
cfg80211: fix in nl80211_set_reg()
There is a race on access to last_request and its alpha2 through reg_is_valid_request() and us possibly processing first another regulatory request on another CPU. We avoid this improbably race by locking with the cfg80211_mutex as we should have done in the first place. While at it add the assert on locking on reg_is_valid_request(). Cc: stable@kernel.org Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/wireless')
-rw-r--r--net/wireless/nl80211.c5
-rw-r--r--net/wireless/reg.c2
2 files changed, 6 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 66e0fb6a642..63250406078 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2570,6 +2570,8 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
return -EINVAL;
}
+ mutex_lock(&cfg80211_mutex);
+
if (!reg_is_valid_request(alpha2)) {
r = -EINVAL;
goto bad_reg;
@@ -2607,13 +2609,14 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
BUG_ON(rule_idx != num_rules);
- mutex_lock(&cfg80211_mutex);
r = set_regdom(rd);
+
mutex_unlock(&cfg80211_mutex);
return r;
bad_reg:
+ mutex_unlock(&cfg80211_mutex);
kfree(rd);
return r;
}
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 48db569d4c6..8d176a8010b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -382,6 +382,8 @@ static int call_crda(const char *alpha2)
/* Used by nl80211 before kmalloc'ing our regulatory domain */
bool reg_is_valid_request(const char *alpha2)
{
+ assert_cfg80211_lock();
+
if (!last_request)
return false;