lkml.org 
[lkml]   [2012]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[048/129] mac80211: fix rx->key NULL pointer dereference in promiscuous mode
    3.2-stable review patch.  If anyone has any objections, please let me know.

    ------------------
    Content-Length: 1479
    Lines: 45

    From: Stanislaw Gruszka <sgruszka@redhat.com>

    commit 1140afa862842ac3e56678693050760edc4ecde9 upstream.

    Since:

    commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
    Author: Christian Lamparter <chunkeey@googlemail.com>
    Date: Sat Apr 30 15:24:30 2011 +0200

    mac80211: consolidate MIC failure report handling

    is possible to that we dereference rx->key == NULL when driver set
    RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
    promiscuous mode. This happen with rt73usb and rt61pci at least.

    Before the commit we always check rx->key against NULL, so I assume
    fix should be done in mac80211 (also mic_fail path has similar check).

    References:
    https://bugzilla.redhat.com/show_bug.cgi?id=769766
    http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html

    Reported-by: Stuart D Gathman <stuart@gathman.org>
    Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com>
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/mac80211/wpa.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/mac80211/wpa.c
    +++ b/net/mac80211/wpa.c
    @@ -106,7 +106,7 @@ ieee80211_rx_h_michael_mic_verify(struct
    if (status->flag & RX_FLAG_MMIC_ERROR)
    goto mic_fail;

    - if (!(status->flag & RX_FLAG_IV_STRIPPED))
    + if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
    goto update_iv;

    return RX_CONTINUE;



    \
     
     \ /
      Last update: 2012-01-24 03:49    [W:0.021 / U:28.924 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site