iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mac80211: don't leave skb->next/prev pointing to stack

Browse Source 
In beacon protection, don't leave skb->next/prev pointing to the
on-stack list, even if that's actually harmless since we don't use
them again afterwards.

While at it, check that the SKB on the list is still the same, as
that's required here. If not, the encryption (protection) code is
buggy.

Fixes: 0a3a84360b ("mac80211: Beacon protection using the new BIGTK (AP)")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20200320102021.1be7823fc05e.Ia89fb79a0469d32137c9a04315a1d2dfc7b7d6f5@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Johannes Berg 2020-03-20 10:20:23 +01:00
parent 07e9733886
commit 95247705c4
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/mac80211/tx.c
View File

@ -4670,6 +4670,7 @@ static int ieee80211_beacon_protect(struct sk_buff *skb,
{
ieee80211_tx_result res;
struct ieee80211_tx_data tx;
struct sk_buff *check_skb;
memset(&tx, 0, sizeof(tx));
tx.key = rcu_dereference(sdata->default_beacon_key);
@ -4680,8 +4681,11 @@ static int ieee80211_beacon_protect(struct sk_buff *skb,
__skb_queue_head_init(&tx.skbs);
__skb_queue_tail(&tx.skbs, skb);
res = ieee80211_tx_h_encrypt(&tx);
check_skb = __skb_dequeue(&tx.skbs);
/* we may crash after this, but it'd be a bug in crypto */
WARN_ON(check_skb != skb);
if (WARN_ON_ONCE(res != TX_CONTINUE))
return -1;
return -EINVAL;
return 0;
}