Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-22 13:02:44 +01:00
Code Releases Activity

netdev: add an ability to cancel hw rekey cmd

Browse Source 
==1628== Invalid read of size 1
==1628==    at 0x405E71: hardware_rekey_cb (netdev.c:1381)
==1628==    by 0x444E5B: process_unicast (genl.c:415)
==1628==    by 0x444E5B: received_data (genl.c:534)
==1628==    by 0x442032: io_callback (io.c:126)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
==1628==  Address 0x5475208 is 312 bytes inside a block of size 320 free'd
==1628==    at 0x4C2ED18: free (vg_replace_malloc.c:530)
==1628==    by 0x43D94D: l_queue_clear (queue.c:107)
==1628==    by 0x43D998: l_queue_destroy (queue.c:82)
==1628==    by 0x40B431: netdev_shutdown (netdev.c:4765)
==1628==    by 0x403B17: iwd_shutdown (main.c:81)
==1628==    by 0x4419D2: signal_callback (signal.c:82)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
==1628==  Block was alloc'd at
==1628==    at 0x4C2DB6B: malloc (vg_replace_malloc.c:299)
==1628==    by 0x43CA4D: l_malloc (util.c:62)
==1628==    by 0x40A853: netdev_create_from_genl (netdev.c:4517)
==1628==    by 0x444E5B: process_unicast (genl.c:415)
==1628==    by 0x444E5B: received_data (genl.c:534)
==1628==    by 0x442032: io_callback (io.c:126)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
This commit is contained in:
Tim Kourt 2018-10-19 14:19:26 -07:00 committed by Denis Kenzior
parent a4f6e66f82
commit e979bf97f1
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/netdev.c
View File

@ -95,6 +95,7 @@ struct netdev {
uint32_t join_adhoc_cmd_id;
uint32_t leave_adhoc_cmd_id;
uint32_t set_interface_cmd_id;
uint32_t rekey_offload_cmd_id;
enum netdev_result result;
struct l_timeout *neighbor_report_timeout;
struct l_timeout *sa_query_timeout;
@ -613,6 +614,11 @@ static void netdev_free(void *data)
netdev->set_powered_cmd_id = 0;
}
if (netdev->rekey_offload_cmd_id) {
l_genl_family_cancel(nl80211, netdev->rekey_offload_cmd_id);
netdev->rekey_offload_cmd_id = 0;
}
if (netdev->device) {
WATCHLIST_NOTIFY(&netdev_watches, netdev_watch_func_t,
netdev, NETDEV_WATCH_EVENT_DEL);
@ -1374,6 +1380,8 @@ static void hardware_rekey_cb(struct l_genl_msg *msg, void *data)
struct netdev *netdev = data;
int err;
netdev->rekey_offload_cmd_id = 0;
err = l_genl_msg_get_error(msg);
if (err < 0) {
if (err == -EOPNOTSUPP) {
@ -1427,10 +1435,10 @@ static void netdev_set_rekey_offload(uint32_t ifindex,
return;
l_debug("%d", netdev->index);
msg = netdev_build_cmd_replay_counter(netdev, kek, kck,
replay_counter);
l_genl_family_send(nl80211, msg, hardware_rekey_cb, netdev, NULL);
msg = netdev_build_cmd_replay_counter(netdev, kek, kck, replay_counter);
netdev->rekey_offload_cmd_id = l_genl_family_send(nl80211, msg,
hardware_rekey_cb,
netdev, NULL);
}
/*