Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

mac80211: fix rx->key NULL dereference during mic failure

Browse source 
Sometimes when reporting a MIC failure rx->key may be unset. This
code path is hit when receiving a packet meant for a multicast
address, and decryption is performed in HW.

Fortunately, the failing key_idx is not used for anything up to
(and including) usermode, so we allow ourselves to drop it on the
way up when a key cannot be retrieved.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Cc: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Arik Nemtsov 2011-06-23 00:00:24 +03:00 committed by John W. Linville
parent 8fcbd4dc7a
commit a66b98db57
3 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
include/net/cfg80211.h
View file

@ -2688,7 +2688,7 @@ void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
* @dev: network device * @dev: network device
* @addr: The source MAC address of the frame * @addr: The source MAC address of the frame
* @key_type: The key type that the received frame used * @key_type: The key type that the received frame used
* @key_id: Key identifier (0..3) * @key_id: Key identifier (0..3). Can be -1 if missing.
* @tsc: The TSC value of the frame that generated the MIC failure (6 octets) * @tsc: The TSC value of the frame that generated the MIC failure (6 octets)
* @gfp: allocation flags * @gfp: allocation flags
* *

8
net/mac80211/wpa.c
View file

@ -154,7 +154,13 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
return RX_CONTINUE; return RX_CONTINUE;
mic_fail: mic_fail:
mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx, /*
* In some cases the key can be unset - e.g. a multicast packet, in
* a driver that supports HW encryption. Send up the key idx only if
* the key is set.
*/
mac80211_ev_michael_mic_failure(rx->sdata,
rx->key ? rx->key->conf.keyidx : -1,
(void *) skb->data, NULL, GFP_ATOMIC); (void *) skb->data, NULL, GFP_ATOMIC);
return RX_DROP_UNUSABLE; return RX_DROP_UNUSABLE;
} }

3
net/wireless/nl80211.c
View file

@ -6463,7 +6463,8 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
if (addr) if (addr)
NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type); NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id); if (key_id != -1)
NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
if (tsc) if (tsc)
NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc); NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);