mac80211: Fix key freeing to handle unlinked keys

Key locking simplification removed key->sdata != NULL verification from
ieee80211_key_free(). While that is fine for most use cases, there is one
path where this function can be called with an unlinked key (i.e.,
key->sdata == NULL && key->local == NULL). This results in a NULL pointer
dereference with the current implementation. This is known to happen at
least with FT protocol when wpa_supplicant tries to configure the key
before association.

Avoid the issue by passing in the local pointer to
ieee80211_key_free(). In addition, do not clear the key from hw_accel
or debugfs if it has not yet been added. At least the hw_accel one could
trigger another NULL pointer dereference.

Signed-off-by: Jouni Malinen <j@w1.fi>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 3 insertions, 3 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index b769567949be..dab6b8efe5fa 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -158,7 +158,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         if (mac_addr) {
                 sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta) {
-                        ieee80211_key_free(key);
+                        ieee80211_key_free(sdata->local, key);
                         err = -ENOENT;
                         goto out_unlock;
                 }
@@ -192,7 +192,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                         goto out_unlock;
 
                 if (sta->key) {
-                        ieee80211_key_free(sta->key);
+                        ieee80211_key_free(sdata->local, sta->key);
                         WARN_ON(sta->key);
                         ret = 0;
                 }
@@ -205,7 +205,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                 goto out_unlock;
         }
 
-        ieee80211_key_free(sdata->keys[key_idx]);
+        ieee80211_key_free(sdata->local, sdata->keys[key_idx]);
         WARN_ON(sdata->keys[key_idx]);
 
         ret = 0;