mac80211: fix CCMP races

Since we can process multiple packets at the
same time for different ACs, but the PN is
allocated from a single counter, we need to
use an atomic value there. Use atomic64_t to
make this cheaper on 64-bit platforms, other
platforms will support this through software
emulation, see lib/atomic64.c.

We also need to use an on-stack scratch buf
so that multiple packets won't corrupt each
others scratch buffers.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 33c58b85c911..4433760db4c7 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -79,6 +79,7 @@ static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
                                 size_t count, loff_t *ppos)
 {
         const u8 *tpn;
+        u64 pn;
         char buf[20];
         int len;
         struct ieee80211_key *key = file->private_data;
@@ -94,9 +95,10 @@ static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
                                 key->u.tkip.tx.iv16);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                tpn = key->u.ccmp.tx_pn;
+                pn = atomic64_read(&key->u.ccmp.tx_pn);
                 len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
-                                tpn[0], tpn[1], tpn[2], tpn[3], tpn[4], tpn[5]);
+                                (u8)(pn >> 40), (u8)(pn >> 32), (u8)(pn >> 24),
+                                (u8)(pn >> 16), (u8)(pn >> 8), (u8)pn);
                 break;
         case WLAN_CIPHER_SUITE_AES_CMAC:
                 tpn = key->u.aes_cmac.tx_pn;