diff options
| author | Ingo Molnar <mingo@elte.hu> | 2008-07-07 08:01:26 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2008-07-07 08:01:26 +0200 |
| commit | 032f82786f9be4635acaa5f77feca175a4ac5fe1 (patch) | |
| tree | 11ce43c1086d3dec43c92b0a2cc740240b338fb7 /net/mac80211 | |
| parent | 46ac22bab42cc868b9c1d0e915ddbc8e8065a44d (diff) | |
| parent | b7279469d66b55119784b8b9529c99c1955fe747 (diff) | |
Merge commit 'v2.6.26-rc9' into sched/devel
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/key.c | 9 | ||||
| -rw-r--r-- | net/mac80211/wext.c | 7 | ||||
| -rw-r--r-- | net/mac80211/wme.c | 3 |
3 files changed, 17 insertions, 2 deletions
diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 150d66dbda9d..220e83be3ef4 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -380,6 +380,15 @@ void ieee80211_key_free(struct ieee80211_key *key) if (!key) return; + if (!key->sdata) { + /* The key has not been linked yet, simply free it + * and don't Oops */ + if (key->conf.alg == ALG_CCMP) + ieee80211_aes_key_free(key->u.ccmp.tfm); + kfree(key); + return; + } + spin_lock_irqsave(&key->sdata->local->key_lock, flags); __ieee80211_key_free(key); spin_unlock_irqrestore(&key->sdata->local->key_lock, flags); diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c index 6106cb79060c..e8404212ad57 100644 --- a/net/mac80211/wext.c +++ b/net/mac80211/wext.c @@ -95,6 +95,13 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr, } } + if (alg == ALG_WEP && + key_len != LEN_WEP40 && key_len != LEN_WEP104) { + ieee80211_key_free(key); + err = -EINVAL; + goto out_unlock; + } + ieee80211_key_link(key, sdata, sta); if (set_tx_key || (!sta && !sdata->default_key && key)) diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c index 635b996c8c35..5d09e8698b57 100644 --- a/net/mac80211/wme.c +++ b/net/mac80211/wme.c @@ -323,8 +323,7 @@ static void wme_qdiscop_destroy(struct Qdisc* qd) struct ieee80211_hw *hw = &local->hw; int queue; - tcf_destroy_chain(q->filter_list); - q->filter_list = NULL; + tcf_destroy_chain(&q->filter_list); for (queue=0; queue < hw->queues; queue++) { skb_queue_purge(&q->requeued[queue]); |