Commit a66b98db authored by Arik Nemtsov's avatar Arik Nemtsov Committed by John W. Linville
Browse files

mac80211: fix rx->key NULL dereference during mic failure 



Sometimes when reporting a MIC failure rx->key may be unset. This
code path is hit when receiving a packet meant for a multicast
address, and decryption is performed in HW.

Fortunately, the failing key_idx is not used for anything up to
(and including) usermode, so we allow ourselves to drop it on the
way up when a key cannot be retrieved.

Signed-off-by: default avatarArik Nemtsov <arik@wizery.com>
Cc: stable@kernel.org
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 8fcbd4dc

include/net/cfg80211.h

+1 −1
Original line number Diff line number Diff line
@@ -2688,7 +2688,7 @@ void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf, 
 * @dev: network device

 * @addr: The source MAC address of the frame

 * @key_type: The key type that the received frame used

 * @key_id: Key identifier (0..3)

 * @key_id: Key identifier (0..3). Can be -1 if missing.

 * @tsc: The TSC value of the frame that generated the MIC failure (6 octets)

 * @gfp: allocation flags

 *

net/mac80211/wpa.c

+7 −1
Original line number Diff line number Diff line
@@ -154,7 +154,13 @@ update_iv: 
	return RX_CONTINUE;



mic_fail:

	mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,

	/*

	 * In some cases the key can be unset - e.g. a multicast packet, in

	 * a driver that supports HW encryption. Send up the key idx only if

	 * the key is set.

	 */

	mac80211_ev_michael_mic_failure(rx->sdata,

					rx->key ? rx->key->conf.keyidx : -1,

					(void *) skb->data, NULL, GFP_ATOMIC);

	return RX_DROP_UNUSABLE;

}

net/wireless/nl80211.c

+2 −1
Original line number Diff line number Diff line
@@ -6463,6 +6463,7 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 
	if (addr)

		NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);

	NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);

	if (key_id != -1)

		NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);

	if (tsc)

		NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);

CRA Git | Maintained and supported by SUSTech CRA and CCSE