]>
Commit | Line | Data |
---|---|---|
0aa96192 GKH |
1 | From 2cf5eb3ab7bb7f2e3a70edcef236cd62c87db030 Mon Sep 17 00:00:00 2001 |
2 | From: Johannes Berg <johannes.berg@intel.com> | |
3 | Date: Tue, 15 Sep 2015 14:36:09 +0200 | |
4 | Subject: iwlwifi: mvm: fix D3 firmware PN programming | |
5 | ||
6 | From: Johannes Berg <johannes.berg@intel.com> | |
7 | ||
8 | commit 2cf5eb3ab7bb7f2e3a70edcef236cd62c87db030 upstream. | |
9 | ||
10 | The code to send the RX PN data (for each TID) to the firmware | |
11 | has a devastating bug: it overwrites the data for TID 0 with | |
12 | all the TID data, leaving the remaining TIDs zeroed. This will | |
13 | allow replays to actually be accepted by the firmware, which | |
14 | could allow waking up the system. | |
15 | ||
16 | Signed-off-by: Johannes Berg <johannes.berg@intel.com> | |
17 | Signed-off-by: Luca Coelho <luciano.coelho@intel.com> | |
18 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
19 | ||
20 | --- | |
21 | drivers/net/wireless/iwlwifi/mvm/d3.c | 12 ++++++------ | |
22 | 1 file changed, 6 insertions(+), 6 deletions(-) | |
23 | ||
24 | --- a/drivers/net/wireless/iwlwifi/mvm/d3.c | |
25 | +++ b/drivers/net/wireless/iwlwifi/mvm/d3.c | |
26 | @@ -297,12 +297,12 @@ static void iwl_mvm_wowlan_program_keys( | |
27 | u8 *pn = seq.ccmp.pn; | |
28 | ||
29 | ieee80211_get_key_rx_seq(key, i, &seq); | |
30 | - aes_sc->pn = cpu_to_le64((u64)pn[5] | | |
31 | - ((u64)pn[4] << 8) | | |
32 | - ((u64)pn[3] << 16) | | |
33 | - ((u64)pn[2] << 24) | | |
34 | - ((u64)pn[1] << 32) | | |
35 | - ((u64)pn[0] << 40)); | |
36 | + aes_sc[i].pn = cpu_to_le64((u64)pn[5] | | |
37 | + ((u64)pn[4] << 8) | | |
38 | + ((u64)pn[3] << 16) | | |
39 | + ((u64)pn[2] << 24) | | |
40 | + ((u64)pn[1] << 32) | | |
41 | + ((u64)pn[0] << 40)); | |
42 | } | |
43 | data->use_rsc_tsc = true; | |
44 | break; |