dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

mac80211: fix tx->skb NULL pointer dereference 

In function ieee80211_tx_h_encrypt the var info was
initialized from tx->skb, since the fucntion
is called after the function ieee80211_tx_h_fragment
tx->skb is not valid anymore.

Signed-off-by: Yoni Divinsky <yoni.divinsky@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Yoni Divinsky 2012-01-16 15:18:59 +02:00 committed by John W. Linville
parent 331d9301ed
commit d32a102819
3 changed files with 22 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/mac80211/tx.c
View File

@ -1001,8 +1001,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
{
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
if (!tx->key)
return TX_CONTINUE;
@ -1017,13 +1015,7 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
case WLAN_CIPHER_SUITE_AES_CMAC:
return ieee80211_crypto_aes_cmac_encrypt(tx);
default:
/* handle hw-only algorithm */
if (info->control.hw_key) {
ieee80211_tx_set_protected(tx);
return TX_CONTINUE;
}
break;
return ieee80211_crypto_hw_encrypt(tx);
}
return TX_DROP;

19
net/mac80211/wpa.c
View File

@ -643,3 +643,22 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
return RX_CONTINUE;
}
ieee80211_tx_result
ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
{
struct sk_buff *skb;
struct ieee80211_tx_info *info = NULL;
skb_queue_walk(&tx->skbs, skb) {
info = IEEE80211_SKB_CB(skb);
/* handle hw-only algorithm */
if (!info->control.hw_key)
return TX_DROP;
}
ieee80211_tx_set_protected(tx);
return TX_CONTINUE;
}

2
net/mac80211/wpa.h
View File

@ -32,5 +32,7 @@ ieee80211_tx_result
ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx);
ieee80211_rx_result
ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx);
ieee80211_tx_result
ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx);
#endif /* WPA_H */