]>
Commit | Line | Data |
---|---|---|
194dfb97 GKH |
1 | From 1140afa862842ac3e56678693050760edc4ecde9 Mon Sep 17 00:00:00 2001 |
2 | From: Stanislaw Gruszka <sgruszka@redhat.com> | |
3 | Date: Wed, 11 Jan 2012 09:26:54 +0100 | |
4 | Subject: mac80211: fix rx->key NULL pointer dereference in promiscuous mode | |
5 | ||
6 | From: Stanislaw Gruszka <sgruszka@redhat.com> | |
7 | ||
8 | commit 1140afa862842ac3e56678693050760edc4ecde9 upstream. | |
9 | ||
10 | Since: | |
11 | ||
12 | commit 816c04fe7ef01dd9649f5ccfe796474db8708be5 | |
13 | Author: Christian Lamparter <chunkeey@googlemail.com> | |
14 | Date: Sat Apr 30 15:24:30 2011 +0200 | |
15 | ||
16 | mac80211: consolidate MIC failure report handling | |
17 | ||
18 | is possible to that we dereference rx->key == NULL when driver set | |
19 | RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in | |
20 | promiscuous mode. This happen with rt73usb and rt61pci at least. | |
21 | ||
22 | Before the commit we always check rx->key against NULL, so I assume | |
23 | fix should be done in mac80211 (also mic_fail path has similar check). | |
24 | ||
25 | References: | |
26 | https://bugzilla.redhat.com/show_bug.cgi?id=769766 | |
27 | http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html | |
28 | ||
29 | Reported-by: Stuart D Gathman <stuart@gathman.org> | |
30 | Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com> | |
31 | Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> | |
32 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | |
33 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
34 | ||
35 | --- | |
36 | net/mac80211/wpa.c | 2 +- | |
37 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
38 | ||
39 | --- a/net/mac80211/wpa.c | |
40 | +++ b/net/mac80211/wpa.c | |
41 | @@ -105,7 +105,7 @@ ieee80211_rx_h_michael_mic_verify(struct | |
42 | if (status->flag & RX_FLAG_MMIC_ERROR) | |
43 | goto mic_fail; | |
44 | ||
45 | - if (!(status->flag & RX_FLAG_IV_STRIPPED)) | |
46 | + if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key) | |
47 | goto update_iv; | |
48 | ||
49 | return RX_CONTINUE; |