mac80211: fix rx->key NULL dereference during mic failure
Sometimes when reporting a MIC failure rx->key may be unset. This code path is hit when receiving a packet meant for a multicast address, and decryption is performed in HW. Fortunately, the failing key_idx is not used for anything up to (and including) usermode, so we allow ourselves to drop it on the way up when a key cannot be retrieved. Signed-off-by: Arik Nemtsov <arik@wizery.com> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
8fcbd4dc7a
commit
a66b98db57
|
@ -2688,7 +2688,7 @@ void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
|
|||
* @dev: network device
|
||||
* @addr: The source MAC address of the frame
|
||||
* @key_type: The key type that the received frame used
|
||||
* @key_id: Key identifier (0..3)
|
||||
* @key_id: Key identifier (0..3). Can be -1 if missing.
|
||||
* @tsc: The TSC value of the frame that generated the MIC failure (6 octets)
|
||||
* @gfp: allocation flags
|
||||
*
|
||||
|
|
|
@ -154,7 +154,13 @@ update_iv:
|
|||
return RX_CONTINUE;
|
||||
|
||||
mic_fail:
|
||||
mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
|
||||
/*
|
||||
* In some cases the key can be unset - e.g. a multicast packet, in
|
||||
* a driver that supports HW encryption. Send up the key idx only if
|
||||
* the key is set.
|
||||
*/
|
||||
mac80211_ev_michael_mic_failure(rx->sdata,
|
||||
rx->key ? rx->key->conf.keyidx : -1,
|
||||
(void *) skb->data, NULL, GFP_ATOMIC);
|
||||
return RX_DROP_UNUSABLE;
|
||||
}
|
||||
|
|
|
@ -6463,7 +6463,8 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
|
|||
if (addr)
|
||||
NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
|
||||
NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
|
||||
NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
|
||||
if (key_id != -1)
|
||||
NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
|
||||
if (tsc)
|
||||
NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
|
||||
|
||||
|
|
Loading…
Reference in a new issue