Re: [PATCH] iwlwifi: fix oops on wep key insertion

[Dan Williams <dcbw@redhat.com>]

On Mon, 2008-06-16 at 10:46 +0200, Johannes Berg wrote:
> > > [PATCH] wireless: Limit wep key size to 128/104-bits
> > >
> > > This patch prevents overflow which is occured by invalid long wep key
> > > insertion
> > >
> > > $sudo iwconfig wlan0 enc AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA
> > >
> > > BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
> > > IP: [memcpy_c+0xb/0x20] memcpy_c+0xb/0x20
> > > PGD 13a590067 PUD 12e471067 PMD 0
> > > Oops: 0000 [1] PREEMPT SMP
> > > CPU 1
> > > ...
> > > Pid: 10, comm: events/1 Not tainted 2.6.26-rc2 #9
> > > ...
> > > Call Trace:
> > >  [iwl4965:iwl4965_rx_scan_start_notif+0xb/0x20] ? :iwl4965:iwl4965_enqueue_hcmd+0x12b/0x220
> > >  [hci_usb:init_module+0xe97/0x28cb0] :iwlcore:iwl_send_cmd_sync+0x67/0x290
> > >  [save_trace+0x3f/0xb0] ? save_trace+0x3f/0xb0
> > > ...
> > >
> > > Signed-off-by: Joonwoo Park <joonwpark81@gmail.com>
> > > ---
> > >  net/wireless/wext.c |   11 ++++++++++-
> 
> I'm sure Jean will cry murder because he expects there are some stupid
> full-mac cards that actually support other sizes.
> 
> Can't somebody just post a patch to mac80211 that only accepts the two
> correct sizes like cfg80211 does?

I'd +1 that.

The hardware that appears to support 152-bit WEP would be driven by
madwifi/ath5k [1] [2], and maybe rtl8185 [3].  Most other references
I've found to 152-bit encryption support are for "108Mbps" or "Turbo"
products, which are almost always Atheros-based chipsets.  Since they
are mac80211-driven cards with ath5k, they will obviously support WPA
too.

The only case I can think of for really supporting 152-bit WEP is if
some fullmac part can't handle WPA but can handle 152-bit WEP.  And no
fullmac parts that I know of support 152-bit WEP.

Dan

[1] http://www.seattlewireless.net/HardwareComparison (Proxim Orinoco Atheros-based)
[2] http://support.dlink.com/products/view.asp?productid=DWL%2DAB650
[3] http://svp.co.uk/product/tp-link_tl-wn353g_54mbps_wireless_pci_adapter_4669