From: Dan Carpenter <dan.carpenter@oracle.com>
To: "Stepanov, Max" <Max.Stepanov@intel.com>
Cc: "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Subject: Re: mac80211: add generic cipher scheme support
Date: Wed, 4 Dec 2013 16:19:06 +0300 [thread overview]
Message-ID: <20131204131905.GT5443@mwanda> (raw)
In-Reply-To: <3A934E7FDB083A4683727C7D377065951172F2E5@HASMSX105.ger.corp.intel.com>
On Wed, Dec 04, 2013 at 01:07:29PM +0000, Stepanov, Max wrote:
> > 304 if (pairwise)
> > 305 key = rcu_dereference(sta->ptk[key_idx]);
> > 306 else if (key_idx < NUM_DEFAULT_KEYS)
> > 307 key = rcu_dereference(sta->gtk[key_idx]);
> >
> >key_idx is a number between 0 and 5.
> >NUM_DEFAULT_KEYS is 4.
> >->ptk has 4 elements.
> >->gtk has 6 elements.
> >
> >I looked but I didn't see that "pairwise" implied that key_idx is less than 4.
> >These are set in nl80211_get_key().
>
> Hi Dan,
>
> 1. ptk - I think you are right here - need to verify that key_idx doesn't exceed sta->ptk array boundaries. I'll prepare the fix
> 2. gtk - frankly I'm not sure about key_idx < NUM_DEFAULT_KEYS. I understand why it's here: not to return management keys, but I don't see a reason why not to do it... In any case I'll prepare the fix for this case too
It worries me that we are doing #2 without being sure... I have no
idea about this code, I'm just doing static analysis without a deep
understanding at all.
regards,
dan carpenter
next prev parent reply other threads:[~2013-12-04 13:19 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-03 16:37 mac80211: add generic cipher scheme support Dan Carpenter
2013-12-04 13:07 ` Stepanov, Max
2013-12-04 13:19 ` Dan Carpenter [this message]
2013-12-04 13:30 ` Stepanov, Max
-- strict thread matches above, loose matches on Subject: below --
2014-07-08 13:43 Dan Carpenter
2014-07-08 14:31 ` Stepanov, Max
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131204131905.GT5443@mwanda \
--to=dan.carpenter@oracle.com \
--cc=Max.Stepanov@intel.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox