| From 47b4e1fc4972cc43a19121bc2608a60aef3bf216 Mon Sep 17 00:00:00 2001 |
| From: Janusz Dziedzic <janusz.dziedzic@tieto.com> |
| Date: Mon, 11 May 2015 11:31:15 +0200 |
| Subject: mac80211: move WEP tailroom size check |
| |
| From: Janusz Dziedzic <janusz.dziedzic@tieto.com> |
| |
| commit 47b4e1fc4972cc43a19121bc2608a60aef3bf216 upstream. |
| |
| Remove checking tailroom when adding IV as it uses only |
| headroom, and move the check to the ICV generation that |
| actually needs the tailroom. |
| |
| In other case I hit such warning and datapath don't work, |
| when testing: |
| - IBSS + WEP |
| - ath9k with hw crypt enabled |
| - IPv6 data (ping6) |
| |
| WARNING: CPU: 3 PID: 13301 at net/mac80211/wep.c:102 ieee80211_wep_add_iv+0x129/0x190 [mac80211]() |
| [...] |
| Call Trace: |
| [<ffffffff817bf491>] dump_stack+0x45/0x57 |
| [<ffffffff8107746a>] warn_slowpath_common+0x8a/0xc0 |
| [<ffffffff8107755a>] warn_slowpath_null+0x1a/0x20 |
| [<ffffffffc09ae109>] ieee80211_wep_add_iv+0x129/0x190 [mac80211] |
| [<ffffffffc09ae7ab>] ieee80211_crypto_wep_encrypt+0x6b/0xd0 [mac80211] |
| [<ffffffffc09d3fb1>] invoke_tx_handlers+0xc51/0xf30 [mac80211] |
| [...] |
| |
| Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com> |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/mac80211/wep.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| --- a/net/mac80211/wep.c |
| +++ b/net/mac80211/wep.c |
| @@ -98,8 +98,7 @@ static u8 *ieee80211_wep_add_iv(struct i |
| |
| hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); |
| |
| - if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN || |
| - skb_headroom(skb) < IEEE80211_WEP_IV_LEN)) |
| + if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN)) |
| return NULL; |
| |
| hdrlen = ieee80211_hdrlen(hdr->frame_control); |
| @@ -169,6 +168,9 @@ int ieee80211_wep_encrypt(struct ieee802 |
| size_t len; |
| u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; |
| |
| + if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN)) |
| + return -1; |
| + |
| iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); |
| if (!iv) |
| return -1; |