| From 1140afa862842ac3e56678693050760edc4ecde9 Mon Sep 17 00:00:00 2001 |
| From: Stanislaw Gruszka <sgruszka@redhat.com> |
| Date: Wed, 11 Jan 2012 09:26:54 +0100 |
| Subject: mac80211: fix rx->key NULL pointer dereference in promiscuous mode |
| |
| From: Stanislaw Gruszka <sgruszka@redhat.com> |
| |
| commit 1140afa862842ac3e56678693050760edc4ecde9 upstream. |
| |
| Since: |
| |
| commit 816c04fe7ef01dd9649f5ccfe796474db8708be5 |
| Author: Christian Lamparter <chunkeey@googlemail.com> |
| Date: Sat Apr 30 15:24:30 2011 +0200 |
| |
| mac80211: consolidate MIC failure report handling |
| |
| is possible to that we dereference rx->key == NULL when driver set |
| RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in |
| promiscuous mode. This happen with rt73usb and rt61pci at least. |
| |
| Before the commit we always check rx->key against NULL, so I assume |
| fix should be done in mac80211 (also mic_fail path has similar check). |
| |
| References: |
| https://bugzilla.redhat.com/show_bug.cgi?id=769766 |
| http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html |
| |
| Reported-by: Stuart D Gathman <stuart@gathman.org> |
| Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com> |
| Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/mac80211/wpa.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/mac80211/wpa.c |
| +++ b/net/mac80211/wpa.c |
| @@ -109,7 +109,7 @@ ieee80211_rx_h_michael_mic_verify(struct |
| if (status->flag & RX_FLAG_MMIC_ERROR) |
| goto mic_fail; |
| |
| - if (!(status->flag & RX_FLAG_IV_STRIPPED)) |
| + if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key) |
| goto update_iv; |
| |
| return RX_CONTINUE; |