Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766)
This commit is contained in:
parent
d45e462d4b
commit
dc54a7e0f4
10
kernel.spec
10
kernel.spec
|
@ -42,7 +42,7 @@ Summary: The Linux kernel
|
|||
# When changing real_sublevel below, reset this by hand to 1
|
||||
# (or to 0 and then use rpmdev-bumpspec).
|
||||
#
|
||||
%global baserelease 1
|
||||
%global baserelease 2
|
||||
%global fedora_build %{baserelease}
|
||||
|
||||
# real_sublevel is the 3.x kernel version we're starting with
|
||||
|
@ -734,6 +734,9 @@ Patch21065: Bluetooth-Add-support-for-BCM20702A0.patch
|
|||
Patch21071: ext4-Fix-error-handling-on-inode-bitmap-corruption.patch
|
||||
Patch21072: ext3-Fix-error-handling-on-inode-bitmap-corruption.patch
|
||||
|
||||
#rhbz 769766
|
||||
Patch21073: mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
|
||||
|
||||
%endif
|
||||
|
||||
BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
|
||||
|
@ -1362,6 +1365,8 @@ ApplyPatch KVM-fix-device-assignment-permissions.patch
|
|||
ApplyPatch ext4-Fix-error-handling-on-inode-bitmap-corruption.patch
|
||||
ApplyPatch ext3-Fix-error-handling-on-inode-bitmap-corruption.patch
|
||||
|
||||
ApplyPatch mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
@ -2009,6 +2014,9 @@ fi
|
|||
# and build.
|
||||
|
||||
%changelog
|
||||
* Wed Jan 11 2012 Josh Boyer <jwboyer@redhat.com>
|
||||
- Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766)
|
||||
|
||||
* Tue Jan 10 2012 Josh Boyer <jwboyer@redhat.com>
|
||||
- Fix ext3/ext4 corrupted bitmap error path (pointed out by Eric Sandeen)
|
||||
|
||||
|
|
|
@ -0,0 +1,47 @@
|
|||
Since:
|
||||
|
||||
commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
|
||||
Author: Christian Lamparter <chunkeey@googlemail.com>
|
||||
Date: Sat Apr 30 15:24:30 2011 +0200
|
||||
|
||||
mac80211: consolidate MIC failure report handling
|
||||
|
||||
is possible to that we dereference rx->key == NULL when driver set
|
||||
RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
|
||||
promiscuous mode. This happen with rt73usb and rt61pci at least.
|
||||
|
||||
Before the commit we always check rx->key against NULL, so I assume
|
||||
fix should be done in mac80211 (also mic_fail path has similar check).
|
||||
|
||||
References:
|
||||
https://bugzilla.redhat.com/show_bug.cgi?id=769766
|
||||
http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html
|
||||
|
||||
Cc: stable@vger.kernel.org # 3.0+
|
||||
Reported-by: Stuart D Gathman <stuart@gathman.org>
|
||||
Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com>
|
||||
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
|
||||
---
|
||||
net/mac80211/wpa.c | 2 +-
|
||||
1 files changed, 1 insertions(+), 1 deletions(-)
|
||||
|
||||
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
|
||||
index 93aab07..422b798 100644
|
||||
--- a/net/mac80211/wpa.c
|
||||
+++ b/net/mac80211/wpa.c
|
||||
@@ -106,7 +106,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
|
||||
if (status->flag & RX_FLAG_MMIC_ERROR)
|
||||
goto mic_fail;
|
||||
|
||||
- if (!(status->flag & RX_FLAG_IV_STRIPPED))
|
||||
+ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
|
||||
goto update_iv;
|
||||
|
||||
return RX_CONTINUE;
|
||||
--
|
||||
1.7.1
|
||||
|
||||
--
|
||||
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
|
||||
the body of a message to majordomo@vger.kernel.org
|
||||
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
Loading…
Reference in New Issue