Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766)

kernel.spec

@@ -54,7 +54,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 3 
+%global baserelease 4
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -858,6 +858,9 @@ Patch21065: Bluetooth-Add-support-for-BCM20702A0.patch
 Patch21070: ext4-Support-check-none-nocheck-mount-options.patch
 Patch21071: ext4-Fix-error-handling-on-inode-bitmap-corruption.patch
 
+#rhbz 769766
+Patch21072: mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
+
 # compat-wireless patches
 Patch50000: compat-wireless-config-fixups.patch
 Patch50001: compat-wireless-change-CONFIG_IWLAGN-CONFIG_IWLWIFI.patch
@@ -1598,6 +1601,8 @@ ApplyPatch ext4-Support-check-none-nocheck-mount-options.patch
 
 ApplyPatch ext4-Fix-error-handling-on-inode-bitmap-corruption.patch
 
+ApplyPatch mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2367,6 +2372,9 @@ fi
 # and build.
 
 %changelog
+* Wed Jan 11 2012 Josh Boyer <jwboyer@redhat.com>
+- Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766)
+
 * Tue Jan 10 2012 John W. Linville <linville@redhat.com>
 - Update compat-wireless snapshot to version 3.2-1
 

mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch

@@ -0,0 +1,47 @@
+Since:
+
+commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
+Author: Christian Lamparter <chunkeey@googlemail.com>
+Date:   Sat Apr 30 15:24:30 2011 +0200
+
+    mac80211: consolidate MIC failure report handling
+
+is possible to that we dereference rx->key == NULL when driver set
+RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
+promiscuous mode. This happen with rt73usb and rt61pci at least.
+
+Before the commit we always check rx->key against NULL, so I assume
+fix should be done in mac80211 (also mic_fail path has similar check).
+
+References:
+https://bugzilla.redhat.com/show_bug.cgi?id=769766
+http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html
+
+Cc: stable@vger.kernel.org # 3.0+
+Reported-by: Stuart D Gathman <stuart@gathman.org>
+Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ net/mac80211/wpa.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index 93aab07..422b798 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -106,7 +106,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
+ 		if (status->flag & RX_FLAG_MMIC_ERROR)
+ 			goto mic_fail;
+ 
+-		if (!(status->flag & RX_FLAG_IV_STRIPPED))
++		if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
+ 			goto update_iv;
+ 
+ 		return RX_CONTINUE;
+-- 
+1.7.1
+
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo@vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html