Re: [PATCH] mac80211 : fix a race with update_tkip_key

Johannes Berg
2009-06-08T06:29:10Z

[-- Attachment #1: Type: text/plain, Size: 1728 bytes --]

On Sun, 2009-06-07 at 21:49 +0000, gregor kowski wrote:
> The mac80211 tkip code won't call update_tkip_key, if some rx packets
> get received without KEY_FLAG_UPLOADED_TO_HARDWARE. This can happen on
> first packet because the hardware key stuff is called asynchronously
> with
> todo workqueue.
>
> This patch workaround that by always calling update_tkip_key if
> the packet wasn't decrypted by the hardware.
>
> Signed-off-by: Gregor Kowski <gregor.kowski@gmail.com>
> Index: linux-2.6/net/mac80211/tkip.c
> ===================================================================
> --- linux-2.6.orig/net/mac80211/tkip.c 2009-06-07 19:32:26.000000000
> +0000
> +++ linux-2.6/net/mac80211/tkip.c 2009-06-07 21:31:31.000000000
> +0000
> @@ -298,19 +298,19 @@
> printk("\n");
> }
> #endif
> - if (key->local->ops->update_tkip_key &&
> - key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
> - u8 bcast[ETH_ALEN] =
> - {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
> - u8 *sta_addr = key->sta->sta.addr;
> + }
> + if (key->local->ops->update_tkip_key &&
> + key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
> + u8 bcast[ETH_ALEN] =
> + {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
> + u8 *sta_addr = key->sta->sta.addr;

There's a quite obvious disconnect between what your patch does and what
your description says, please fix one of them. As it is, the patch only
skips the IV rollover which is *completely* wrong because it will call
the function for *every* packet.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]