From 7829934f47724d7d3b0b1be3603ea6c7bf9f08f8 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Wed, 11 Jan 2012 11:12:31 -0500 Subject: [PATCH] Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766) --- kernel.spec | 10 +++- ...y-NULL-ptr-deref-in-promiscuous-mode.patch | 47 +++++++++++++++++++ 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch diff --git a/kernel.spec b/kernel.spec index 9624022a8..5f46d6fee 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 3 +%global baserelease 4 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -858,6 +858,9 @@ Patch21065: Bluetooth-Add-support-for-BCM20702A0.patch Patch21070: ext4-Support-check-none-nocheck-mount-options.patch Patch21071: ext4-Fix-error-handling-on-inode-bitmap-corruption.patch +#rhbz 769766 +Patch21072: mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch + # compat-wireless patches Patch50000: compat-wireless-config-fixups.patch Patch50001: compat-wireless-change-CONFIG_IWLAGN-CONFIG_IWLWIFI.patch @@ -1598,6 +1601,8 @@ ApplyPatch ext4-Support-check-none-nocheck-mount-options.patch ApplyPatch ext4-Fix-error-handling-on-inode-bitmap-corruption.patch +ApplyPatch mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch + # END OF PATCH APPLICATIONS %endif @@ -2367,6 +2372,9 @@ fi # and build. %changelog +* Wed Jan 11 2012 Josh Boyer +- Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766) + * Tue Jan 10 2012 John W. Linville - Update compat-wireless snapshot to version 3.2-1 diff --git a/mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch b/mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch new file mode 100644 index 000000000..abacee637 --- /dev/null +++ b/mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch @@ -0,0 +1,47 @@ +Since: + +commit 816c04fe7ef01dd9649f5ccfe796474db8708be5 +Author: Christian Lamparter +Date: Sat Apr 30 15:24:30 2011 +0200 + + mac80211: consolidate MIC failure report handling + +is possible to that we dereference rx->key == NULL when driver set +RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in +promiscuous mode. This happen with rt73usb and rt61pci at least. + +Before the commit we always check rx->key against NULL, so I assume +fix should be done in mac80211 (also mic_fail path has similar check). + +References: +https://bugzilla.redhat.com/show_bug.cgi?id=769766 +http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html + +Cc: stable@vger.kernel.org # 3.0+ +Reported-by: Stuart D Gathman +Reported-by: Kai Wohlfahrt +Signed-off-by: Stanislaw Gruszka +--- + net/mac80211/wpa.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c +index 93aab07..422b798 100644 +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -106,7 +106,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) + if (status->flag & RX_FLAG_MMIC_ERROR) + goto mic_fail; + +- if (!(status->flag & RX_FLAG_IV_STRIPPED)) ++ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key) + goto update_iv; + + return RX_CONTINUE; +-- +1.7.1 + +-- +To unsubscribe from this list: send the line "unsubscribe linux-wireless" in +the body of a message to majordomo@vger.kernel.org +More majordomo info at http://vger.kernel.org/majordomo-info.html \ No newline at end of file