* [PATCH v2] mac80211: check pairwise key_idx on get_key call
@ 2013-12-08 11:30 Max.Stepanov
2013-12-16 14:10 ` Johannes Berg
0 siblings, 1 reply; 2+ messages in thread
From: Max.Stepanov @ 2013-12-08 11:30 UTC (permalink / raw)
To: linux-wireless; +Cc: Max Stepanov
From: Max Stepanov <Max.Stepanov@intel.com>
Verify that a pairwise key index value on ieee80211_get_key call
doesn't exceed the boundaries of the pairwise key array.
Signed-off-by: Max Stepanov <Max.Stepanov@intel.com>
---
net/mac80211/cfg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8e70df0..00fa219 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -301,9 +301,9 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
if (!sta)
goto out;
- if (pairwise)
+ if (pairwise && key_idx < NUM_DEFAULT_KEYS)
key = rcu_dereference(sta->ptk[key_idx]);
- else if (key_idx < NUM_DEFAULT_KEYS)
+ else if (!pairwise && key_idx < NUM_DEFAULT_KEYS)
key = rcu_dereference(sta->gtk[key_idx]);
} else
key = rcu_dereference(sdata->keys[key_idx]);
--
1.8.5.rc2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] mac80211: check pairwise key_idx on get_key call
2013-12-08 11:30 [PATCH v2] mac80211: check pairwise key_idx on get_key call Max.Stepanov
@ 2013-12-16 14:10 ` Johannes Berg
0 siblings, 0 replies; 2+ messages in thread
From: Johannes Berg @ 2013-12-16 14:10 UTC (permalink / raw)
To: Max.Stepanov; +Cc: linux-wireless
On Sun, 2013-12-08 at 13:30 +0200, Max.Stepanov@intel.com wrote:
> From: Max Stepanov <Max.Stepanov@intel.com>
>
> Verify that a pairwise key index value on ieee80211_get_key call
> doesn't exceed the boundaries of the pairwise key array.
Applied.
johannes
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-12-16 14:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-08 11:30 [PATCH v2] mac80211: check pairwise key_idx on get_key call Max.Stepanov
2013-12-16 14:10 ` Johannes Berg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).