lkml.org 
[lkml]   [2015]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13.y-ckt 37/80] nl80211: fix per-station group key get/del and memory leak
    Date
    3.13.11-ckt17 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johannes Berg <johannes.berg@intel.com>

    commit 0fa7b39131576dd1baa6ca17fca53c65d7f62249 upstream.

    In case userspace attempts to obtain key information for or delete a
    unicast key, this is currently erroneously rejected unless the driver
    sets the WIPHY_FLAG_IBSS_RSN flag. Apparently enough drivers do so it
    was never noticed.

    Fix that, and while at it fix a potential memory leak: the error path
    in the get_key() function was placed after allocating a message but
    didn't free it - move it to a better place. Luckily admin permissions
    are needed to call this operation.

    Fixes: e31b82136d1ad ("cfg80211/mac80211: allow per-station GTKs")
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    net/wireless/nl80211.c | 9 ++++-----
    1 file changed, 4 insertions(+), 5 deletions(-)

    diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    index 16616f1..30caa5c 100644
    --- a/net/wireless/nl80211.c
    +++ b/net/wireless/nl80211.c
    @@ -2681,6 +2681,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
    if (!rdev->ops->get_key)
    return -EOPNOTSUPP;

    + if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
    + return -ENOENT;
    +
    msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
    if (!msg)
    return -ENOMEM;
    @@ -2700,10 +2703,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
    goto nla_put_failure;

    - if (pairwise && mac_addr &&
    - !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
    - return -ENOENT;
    -
    err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
    get_key_callback);

    @@ -2874,7 +2873,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
    wdev_lock(dev->ieee80211_ptr);
    err = nl80211_key_allowed(dev->ieee80211_ptr);

    - if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
    + if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
    err = -ENOENT;

    --
    1.9.1


    \
     
     \ /
      Last update: 2015-03-20 00:01    [W:4.201 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site