| Message ID | 20170802105310.GB4777@redhat.com (mailing list archive) |
|---|---|
| State | Rejected |
| Delegated to: | Johannes Berg |
| Headers | show |
On Wed, 2017-08-02 at 12:53 +0200, Stanislaw Gruszka wrote: > For historic reasons we have separate cases for mic_fail and > mic_fail_no_key. But with current code we can merge those cases, > as we already have NULL key check since commit a66b98db570a > ("mac80211: fix rx->key NULL dereference during mic failure"). > Uh, no. rx->key->u.tkip.mic_failures will still crash. johannes
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c index 0d722ea..98fd9a0 100644 --- a/net/mac80211/wpa.c +++ b/net/mac80211/wpa.c @@ -111,7 +111,7 @@ */ if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) { if (status->flag & RX_FLAG_MMIC_ERROR) - goto mic_fail_no_key; + goto mic_fail; if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP) @@ -170,7 +170,6 @@ mic_fail: rx->key->u.tkip.mic_failures++; -mic_fail_no_key: /* * In some cases the key can be unset - e.g. a multicast packet, in * a driver that supports HW encryption. Send up the key idx only if
For historic reasons we have separate cases for mic_fail and mic_fail_no_key. But with current code we can merge those cases, as we already have NULL key check since commit a66b98db570a ("mac80211: fix rx->key NULL dereference during mic failure"). Patch makes the rx->key->u.tkip.mic_failures statistics increase on all cases when RX_FLAG_MMIC_ERROR is set. Reported-by: Michael Skeffington <mike@astro.ai> Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> --- v1 -> v2 : use preferred commit format in the changelog. net/mac80211/wpa.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)