diff options
| author | Janusz Dziedzic <janusz.dziedzic@tieto.com> | 2015-05-11 11:31:15 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2015-08-07 00:32:10 +0100 |
| commit | 06b9576ec258ff39f0f95a226c49a03d7aca68a1 (patch) | |
| tree | fb06b7debb1d3e930a0f06af30ad6459bbc9eb2c /net | |
| parent | ee156f0adfe053ba0a745cd77c7d697cbd153014 (diff) | |
| download | kernel_samsung_smdk4412-06b9576ec258ff39f0f95a226c49a03d7aca68a1.zip kernel_samsung_smdk4412-06b9576ec258ff39f0f95a226c49a03d7aca68a1.tar.gz kernel_samsung_smdk4412-06b9576ec258ff39f0f95a226c49a03d7aca68a1.tar.bz2 | |
mac80211: move WEP tailroom size check
commit 47b4e1fc4972cc43a19121bc2608a60aef3bf216 upstream.
Remove checking tailroom when adding IV as it uses only
headroom, and move the check to the ICV generation that
actually needs the tailroom.
In other case I hit such warning and datapath don't work,
when testing:
- IBSS + WEP
- ath9k with hw crypt enabled
- IPv6 data (ping6)
WARNING: CPU: 3 PID: 13301 at net/mac80211/wep.c:102 ieee80211_wep_add_iv+0x129/0x190 [mac80211]()
[...]
Call Trace:
[<ffffffff817bf491>] dump_stack+0x45/0x57
[<ffffffff8107746a>] warn_slowpath_common+0x8a/0xc0
[<ffffffff8107755a>] warn_slowpath_null+0x1a/0x20
[<ffffffffc09ae109>] ieee80211_wep_add_iv+0x129/0x190 [mac80211]
[<ffffffffc09ae7ab>] ieee80211_crypto_wep_encrypt+0x6b/0xd0 [mac80211]
[<ffffffffc09d3fb1>] invoke_tx_handlers+0xc51/0xf30 [mac80211]
[...]
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.2: s/IEEE80211_WEP/WEP/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/wep.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c index a1c6bfd..34583c5 100644 --- a/net/mac80211/wep.c +++ b/net/mac80211/wep.c @@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local, hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); - if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN || - skb_headroom(skb) < WEP_IV_LEN)) + if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN)) return NULL; hdrlen = ieee80211_hdrlen(hdr->frame_control); @@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, size_t len; u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; + if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN)) + return -1; + iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); if (!iv) return -1; |