Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 1140afa862842ac3e56678693050760edc4ecde9

Authored by Stanislaw Gruszka
Committed by John W. Linville
1 parent bdd3ae3d1e
Exists in master and in 6 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

mac80211: fix rx->key NULL pointer dereference in promiscuous mode 

Since:

commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
Author: Christian Lamparter <chunkeey@googlemail.com>
Date:   Sat Apr 30 15:24:30 2011 +0200

    mac80211: consolidate MIC failure report handling

is possible to that we dereference rx->key == NULL when driver set
RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
promiscuous mode. This happen with rt73usb and rt61pci at least.

Before the commit we always check rx->key against NULL, so I assume
fix should be done in mac80211 (also mic_fail path has similar check).

References:
https://bugzilla.redhat.com/show_bug.cgi?id=769766
http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html

Cc: stable@vger.kernel.org # 3.0+
Reported-by: Stuart D Gathman <stuart@gathman.org>
Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

... ... @@ -106,7 +106,7 @@
106 106 if (status->flag & RX_FLAG_MMIC_ERROR)
107 107 goto mic_fail;
108 108  
109   - if (!(status->flag & RX_FLAG_IV_STRIPPED))
  109 + if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
110 110 goto update_iv;
111 111  
112 112 return RX_CONTINUE;