| From 4e783d14602aa1939b84a5089b24611d87e0051f Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 1 Nov 2021 10:46:57 +0800 |
| Subject: mac80211: do not access the IV when it was stripped |
| |
| From: Xing Song <xing.song@mediatek.com> |
| |
| [ Upstream commit 77dfc2bc0bb4b8376ecd7a430f27a4a8fff6a5a0 ] |
| |
| ieee80211_get_keyid() will return false value if IV has been stripped, |
| such as return 0 for IP/ARP frames due to LLC header, and return -EINVAL |
| for disassociation frames due to its length... etc. Don't try to access |
| it if it's not present. |
| |
| Signed-off-by: Xing Song <xing.song@mediatek.com> |
| Link: https://lore.kernel.org/r/20211101024657.143026-1-xing.song@mediatek.com |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/mac80211/rx.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c |
| index b7979c0bffd0f..6a24431b90095 100644 |
| --- a/net/mac80211/rx.c |
| +++ b/net/mac80211/rx.c |
| @@ -1945,7 +1945,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) |
| int keyid = rx->sta->ptk_idx; |
| sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); |
| |
| - if (ieee80211_has_protected(fc)) { |
| + if (ieee80211_has_protected(fc) && |
| + !(status->flag & RX_FLAG_IV_STRIPPED)) { |
| cs = rx->sta->cipher_scheme; |
| keyid = ieee80211_get_keyid(rx->skb, cs); |
| |
| -- |
| 2.33.0 |
| |
