|
 |
34e654d |
Since:
|
|
|
34e654d |
|
|
|
34e654d |
commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
|
|
|
34e654d |
Author: Christian Lamparter <chunkeey@googlemail.com>
|
|
|
34e654d |
Date: Sat Apr 30 15:24:30 2011 +0200
|
|
|
34e654d |
|
|
|
34e654d |
mac80211: consolidate MIC failure report handling
|
|
|
34e654d |
|
|
|
34e654d |
is possible to that we dereference rx->key == NULL when driver set
|
|
|
34e654d |
RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
|
|
|
34e654d |
promiscuous mode. This happen with rt73usb and rt61pci at least.
|
|
|
34e654d |
|
|
|
34e654d |
Before the commit we always check rx->key against NULL, so I assume
|
|
|
34e654d |
fix should be done in mac80211 (also mic_fail path has similar check).
|
|
|
34e654d |
|
|
|
34e654d |
References:
|
|
|
34e654d |
https://bugzilla.redhat.com/show_bug.cgi?id=769766
|
|
|
34e654d |
http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html
|
|
|
34e654d |
|
|
|
34e654d |
Cc: stable@vger.kernel.org # 3.0+
|
|
|
34e654d |
Reported-by: Stuart D Gathman <stuart@gathman.org>
|
|
|
34e654d |
Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com>
|
|
|
34e654d |
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
|
|
|
34e654d |
---
|
|
|
34e654d |
net/mac80211/wpa.c | 2 +-
|
|
|
34e654d |
1 files changed, 1 insertions(+), 1 deletions(-)
|
|
|
34e654d |
|
|
|
34e654d |
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
|
|
|
34e654d |
index 93aab07..422b798 100644
|
|
|
34e654d |
--- a/net/mac80211/wpa.c
|
|
|
34e654d |
+++ b/net/mac80211/wpa.c
|
|
|
34e654d |
@@ -106,7 +106,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
|
|
|
34e654d |
if (status->flag & RX_FLAG_MMIC_ERROR)
|
|
|
34e654d |
goto mic_fail;
|
|
|
34e654d |
|
|
|
34e654d |
- if (!(status->flag & RX_FLAG_IV_STRIPPED))
|
|
|
34e654d |
+ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
|
|
|
34e654d |
goto update_iv;
|
|
|
34e654d |
|
|
|
34e654d |
return RX_CONTINUE;
|
|
|
34e654d |
--
|
|
|
34e654d |
1.7.1
|
|
|
34e654d |
|
|
|
34e654d |
--
|
|
|
34e654d |
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
|
|
|
34e654d |
the body of a message to majordomo@vger.kernel.org
|
|
|
34e654d |
More majordomo info at http://vger.kernel.org/majordomo-info.html
|