Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-10 15:10:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux-stable/net/mac80211
History
Stanislaw Gruszka 1140afa862 mac80211: fix rx->key NULL pointer dereference in promiscuous mode 
Since:

commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
Author: Christian Lamparter <chunkeey@googlemail.com>
Date:   Sat Apr 30 15:24:30 2011 +0200

    mac80211: consolidate MIC failure report handling

is possible to that we dereference rx->key == NULL when driver set
RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
promiscuous mode. This happen with rt73usb and rt61pci at least.

Before the commit we always check rx->key against NULL, so I assume
fix should be done in mac80211 (also mic_fail path has similar check).

References:
https://bugzilla.redhat.com/show_bug.cgi?id=769766
http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html

Cc: stable@vger.kernel.org # 3.0+
Reported-by: Stuart D Gathman <stuart@gathman.org>
Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-01-11 15:14:50 -05:00
..
aes_ccm.c
mac80211: use AES_BLOCK_SIZE
2011-07-08 11:11:24 -04:00
aes_ccm.h
mac80211: use AES_BLOCK_SIZE
2011-07-08 11:11:24 -04:00
aes_cmac.c
mac80211: use AES_BLOCK_SIZE
2011-07-08 11:11:24 -04:00
aes_cmac.h
mac80211: fix CMAC races
2011-07-08 11:11:20 -04:00
agg-rx.c
mac80211: Add HT operation modes for IBSS
2011-12-06 16:05:25 -05:00
agg-tx.c
mac80211: split addba retries in time
2011-12-19 14:31:37 -05:00
cfg.c
cfg80211: Return beacon loss count in station
2011-12-19 14:34:13 -05:00
cfg.h
[MAC80211]: rename ieee80211_cfg.h to cfg.h
2007-10-10 16:52:34 -07:00
chan.c
mac80211: fix channel type recalculation with HT and non-HT interfaces
2011-03-14 14:46:58 -04:00
debugfs_key.c
mac80211: fix CMAC races
2011-07-08 11:11:20 -04:00
debugfs_key.h
mac80211: support separate default keys
2010-12-13 15:23:29 -05:00
debugfs_netdev.c
mac80211: count authorized stations per BSS
2011-12-15 14:46:34 -05:00
debugfs_netdev.h
mac80211: reduce reliance on netdev
2009-12-21 18:38:52 -05:00
debugfs_sta.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
2011-12-02 15:44:03 -05:00
debugfs_sta.h
mac80211: RCU-ify STA info structure access
2008-03-06 15:30:46 -05:00
debugfs.c
mac80211: remove debugfs noack test
2011-11-28 14:34:15 -05:00
debugfs.h
mac80211: refactor debugfs function generation code
2010-11-15 13:24:48 -05:00
driver-ops.h
mac80211: do not pass AP VLAN vif pointers to drivers
2011-11-28 14:43:52 -05:00
driver-trace.c
mac80211: fix sparse warnings/errors
2009-08-04 16:43:25 -04:00
driver-trace.h
mac80211: remove tracing config symbol
2011-11-28 14:44:09 -05:00
event.c
cfg80211: use proper allocation flags
2009-07-10 15:01:49 -04:00
ht.c
mac80211: Use appropriate TID for sending BAR, ADDBA and DELBA frames
2011-12-15 14:46:35 -05:00
ibss.c
mac80211: delay IBSS station insertion
2011-12-15 14:46:34 -05:00
ieee80211_i.h
mac80211: remove dead code
2012-01-04 14:31:47 -05:00
iface.c
mac80211: refactor station state transitions
2011-12-15 14:46:34 -05:00
Kconfig
mac80211: remove tracing config symbol
2011-11-28 14:44:09 -05:00
key.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
2011-11-22 14:05:46 -05:00
key.h
mac80211: allow driver to disconnect after resume
2011-07-13 14:49:43 -04:00
led.c
net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules
2011-10-31 19:30:30 -04:00
led.h
mac80211: selective throughput LED trigger active
2010-12-22 14:33:37 -05:00
main.c
mac80211: don't check sdata_running in vif notifier
2011-12-13 15:34:15 -05:00
Makefile
mac80211: remove tracing config symbol
2011-11-28 14:44:09 -05:00
mesh_hwmp.c
mac80211: don't initiate path discovery when forwarding frame with unknown DA
2011-11-28 14:44:07 -05:00
mesh_pathtbl.c
mac80211: don't initiate path discovery when forwarding frame with unknown DA
2011-11-28 14:44:07 -05:00
mesh_plink.c
mac80211: refactor station state transitions
2011-12-15 14:46:34 -05:00
mesh.c
{nl,cfg,mac}80211: implement dot11MeshHWMPperrMinInterval
2011-11-28 14:44:06 -05:00
mesh.h
mac80211: don't initiate path discovery when forwarding frame with unknown DA
2011-11-28 14:44:07 -05:00
michael.c
mac80211: remove ieee80211_get_hdr_info
2008-07-08 14:16:01 -04:00
michael.h
mac80211: remove ieee80211_get_hdr_info
2008-07-08 14:16:01 -04:00
mlme.c
mac80211: use RCU read locks for sta_info_get
2012-01-04 14:30:46 -05:00
offchannel.c
mac80211: remove dead code
2012-01-04 14:31:47 -05:00
pm.c
mac80211: verify virtual interfaces in driver API
2011-11-09 16:01:02 -05:00
rate.c
net: Fix files explicitly needing to include module.h
2011-10-31 19:30:28 -04:00
rate.h
mac80211: add the minstrel_ht rate control algorithm
2010-06-02 16:12:59 -04:00
rc80211_minstrel_debugfs.c
net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules
2011-10-31 19:30:30 -04:00
rc80211_minstrel_ht_debugfs.c
net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules
2011-10-31 19:30:30 -04:00
rc80211_minstrel_ht.c
minstrel_ht: Remove unused function parameters
2011-11-17 15:43:58 -05:00
rc80211_minstrel_ht.h
minstrel_ht: move minstrel_mcs_groups declaration to header file
2010-06-24 15:42:18 -04:00
rc80211_minstrel.c
minstrel: Remove unused function parameter in calc_rate_durations()
2011-11-11 12:32:52 -05:00
rc80211_minstrel.h
minstrel_ht: fixed rate mode through debugfs
2011-06-01 15:12:29 -04:00
rc80211_pid_algo.c
net: fix assignment of 0/1 to bool variables.
2011-12-19 22:27:29 -05:00
rc80211_pid_debugfs.c
net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules
2011-10-31 19:30:30 -04:00
rc80211_pid.h
Fix common misspellings
2011-03-31 11:26:23 -03:00
rx.c
mac80211: Remove superfluous ieee80211_rx_h_remove_qos_control
2012-01-04 14:28:07 -05:00
scan.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
2012-01-05 10:13:24 -05:00
spectmgmt.c
mac80211: Remove unnecessary OOM logging messages
2011-09-13 15:45:02 -04:00
sta_info.c
mac80211: fix kernel panic in IBSS due to a regression
2012-01-04 14:30:46 -05:00
sta_info.h
cfg80211: Return beacon loss count in station
2011-12-19 14:34:13 -05:00
status.c
mac80211: Make use of ieee80211_is_* functions in tx status path
2011-12-13 15:30:46 -05:00
tkip.c
net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules
2011-10-31 19:30:30 -04:00
tkip.h
mac80211: fix TKIP races, make API easier to use
2011-07-08 11:11:19 -04:00
tx.c
mac80211: Use appropriate TID for sending BAR, ADDBA and DELBA frames
2011-12-15 14:46:35 -05:00
util.c
mac80211: Call driver commands after drv_start in mac80211 restart code
2012-01-04 14:31:46 -05:00
wep.c
mac80211: use skb list for fragments
2011-11-21 16:20:42 -05:00
wep.h
mac80211: remove the dependency on crypto_blkcipher
2011-04-04 16:20:00 -04:00
wme.c
mac80211: fix forwarded mesh frame queue mapping
2011-11-28 14:44:05 -05:00
wme.h
mac80211: fix forwarded mesh frame queue mapping
2011-11-28 14:44:05 -05:00
work.c
mac80211: revert on-channel work optimisations
2011-11-30 15:08:31 -05:00
wpa.c
mac80211: fix rx->key NULL pointer dereference in promiscuous mode
2012-01-11 15:14:50 -05:00
wpa.h
mac80211: 802.11w - Add BIP (AES-128-CMAC)
2009-01-29 16:00:02 -05:00