From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Stanislaw Gruszka <sgruszka@redhat.com>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [ 28/34] mac80211: check if key has TKIP type before updating IV
Date: Mon, 29 Oct 2012 13:07:59 -0700 [thread overview]
Message-ID: <20121029200423.685764605@linuxfoundation.org> (raw)
In-Reply-To: <20121029200420.550338074@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <sgruszka@redhat.com>
commit 4045f72bcf3c293c7c5932ef001742d8bb5ded76 upstream.
This patch fix corruption which can manifest itself by following crash
when switching on rfkill switch with rt2x00 driver:
https://bugzilla.redhat.com/attachment.cgi?id=615362
Pointer key->u.ccmp.tfm of group key get corrupted in:
ieee80211_rx_h_michael_mic_verify():
/* update IV in key information to be able to detect replays */
rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
because rt2x00 always set RX_FLAG_MMIC_STRIPPED, even if key is not TKIP.
We already check type of the key in different path in
ieee80211_rx_h_michael_mic_verify() function, so adding additional
check here is reasonable.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/wpa.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -109,7 +109,8 @@ ieee80211_rx_h_michael_mic_verify(struct
if (status->flag & RX_FLAG_MMIC_ERROR)
goto mic_fail;
- if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
+ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
+ rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
goto update_iv;
return RX_CONTINUE;
next prev parent reply other threads:[~2012-10-29 20:07 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-29 20:07 [ 00/34] 3.0.50-stable review Greg Kroah-Hartman
2012-10-29 20:07 ` [ 01/34] gen_init_cpio: avoid stack overflow when expanding Greg Kroah-Hartman
2012-10-29 20:07 ` [ 02/34] fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check Greg Kroah-Hartman
2012-10-29 20:07 ` [ 03/34] drivers/rtc/rtc-imxdi.c: add missing spin lock initialization Greg Kroah-Hartman
2012-10-29 20:07 ` [ 04/34] genalloc: stop crashing the system when destroying a pool Greg Kroah-Hartman
2012-10-29 20:07 ` [ 05/34] ARM: 7559/1: smp: switch away from the idmap before updating init_mm.mm_count Greg Kroah-Hartman
2012-10-29 20:07 ` [ 06/34] SUNRPC: Get rid of the xs_error_report socket callback Greg Kroah-Hartman
2012-10-29 20:07 ` [ 07/34] SUNRPC: Clear the connect flag when socket state is TCP_CLOSE_WAIT Greg Kroah-Hartman
2012-10-29 20:07 ` [ 08/34] Revert "SUNRPC: Ensure we close the socket on EPIPE errors too..." Greg Kroah-Hartman
2012-10-29 20:07 ` [ 09/34] SUNRPC: Prevent races in xs_abort_connection() Greg Kroah-Hartman
2012-10-29 20:07 ` [ 10/34] sysfs: sysfs_pathname/sysfs_add_one: Use strlcat() instead of strcat() Greg Kroah-Hartman
2012-10-29 20:07 ` [ 11/34] ehci: fix Lucid nohandoff pci quirk to be more generic with BIOS versions Greg Kroah-Hartman
2012-10-29 20:07 ` [ 12/34] ehci: Add yet-another Lucid nohandoff pci quirk Greg Kroah-Hartman
2012-10-29 20:07 ` [ 13/34] usb-storage: add unusual_devs entry for Casio EX-N1 digital camera Greg Kroah-Hartman
2012-10-29 20:07 ` [ 14/34] usb hub: send clear_tt_buffer_complete events when canceling TT clear work Greg Kroah-Hartman
2012-10-29 20:07 ` [ 15/34] USB: whiteheat: fix memory leak in error path Greg Kroah-Hartman
2012-10-29 20:07 ` [ 16/34] USB: opticon: fix DMA from stack Greg Kroah-Hartman
2012-10-29 20:07 ` [ 17/34] USB: opticon: fix memory leak in error path Greg Kroah-Hartman
2012-10-29 20:07 ` [ 18/34] USB: serial: Fix memory leak in sierra_release() Greg Kroah-Hartman
2012-10-29 20:07 ` [ 19/34] USB: sierra: fix memory leak in attach error path Greg Kroah-Hartman
2012-10-29 20:07 ` [ 20/34] USB: sierra: fix memory leak in probe " Greg Kroah-Hartman
2012-10-29 20:07 ` [ 21/34] USB: mos7840: fix urb leak at release Greg Kroah-Hartman
2012-10-29 20:07 ` [ 22/34] USB: mos7840: fix port-device leak in error path Greg Kroah-Hartman
2012-10-29 20:07 ` [ 23/34] USB: mos7840: remove NULL-urb submission Greg Kroah-Hartman
2012-10-29 20:07 ` [ 24/34] USB: mos7840: remove invalid disconnect handling Greg Kroah-Hartman
2012-10-29 20:07 ` [ 25/34] xhci: Fix potential NULL ptr deref in command cancellation Greg Kroah-Hartman
2012-10-29 20:07 ` [ 26/34] vhost: fix mergeable bufs on BE hosts Greg Kroah-Hartman
2012-10-29 20:07 ` [ 27/34] ARM: at91/i2c: change id to let i2c-gpio work Greg Kroah-Hartman
2012-10-29 20:07 ` Greg Kroah-Hartman [this message]
2012-10-29 20:08 ` [ 29/34] bcma: fix unregistration of cores Greg Kroah-Hartman
2012-10-29 20:08 ` [ 30/34] cpufreq / powernow-k8: Remove usage of smp_processor_id() in preemptible code Greg Kroah-Hartman
2012-10-29 20:08 ` [ 31/34] x86, mm: Find_early_table_space based on ranges that are actually being mapped Greg Kroah-Hartman
2012-10-29 20:08 ` [ 32/34] x86, mm: Undo incorrect revert in arch/x86/mm/init.c Greg Kroah-Hartman
2012-10-29 20:08 ` [ 33/34] staging: comedi: amplc_pc236: fix invalid register access during detach Greg Kroah-Hartman
2012-10-29 20:08 ` [ 34/34] drm/i915: no lvds quirk for Zotac ZDBOX SD ID12/ID13 Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121029200423.685764605@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=sgruszka@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).