diff options
| author | Felix Fietkau | 2019-01-29 11:10:57 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2019-02-15 08:10:12 +0100 |
| commit | a4c77aac0d5c19a15c6673f3cd510ebbbea76a72 (patch) | |
| tree | 0fe065f6fec8765fc01c04d7a5fa050699bd0598 /net/mac80211 | |
| parent | mic: vop: Fix use-after-free on remove (diff) | |
| download | kernel-qcow2-linux-a4c77aac0d5c19a15c6673f3cd510ebbbea76a72.tar.gz kernel-qcow2-linux-a4c77aac0d5c19a15c6673f3cd510ebbbea76a72.tar.xz kernel-qcow2-linux-a4c77aac0d5c19a15c6673f3cd510ebbbea76a72.zip | |
mac80211: ensure that mgmt tx skbs have tailroom for encryption
commit 9d0f50b80222dc273e67e4e14410fcfa4130a90c upstream.
Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management
frames need to be software encrypted. Since normal data packets are still
encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented
after key upload to hw. This can lead to passing skbs to ccmp_encrypt_skb,
which don't have the necessary tailroom for software encryption.
Change the code to add tailroom for encrypted management packets, even if
crypto_tx_tailroom_needed_cnt is 0.
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/tx.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 995a491f73a9..c7ccd7b71b15 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1913,9 +1913,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, int head_need, bool may_encrypt) { struct ieee80211_local *local = sdata->local; + struct ieee80211_hdr *hdr; + bool enc_tailroom; int tail_need = 0; - if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) { + hdr = (struct ieee80211_hdr *) skb->data; + enc_tailroom = may_encrypt && + (sdata->crypto_tx_tailroom_needed_cnt || + ieee80211_is_mgmt(hdr->frame_control)); + + if (enc_tailroom) { tail_need = IEEE80211_ENCRYPT_TAILROOM; tail_need -= skb_tailroom(skb); tail_need = max_t(int, tail_need, 0); @@ -1923,8 +1930,7 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, if (skb_cloned(skb) && (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) || - !skb_clone_writable(skb, ETH_HLEN) || - (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt))) + !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom)) I802_DEBUG_INC(local->tx_expand_skb_head_cloned); else if (head_need || tail_need) I802_DEBUG_INC(local->tx_expand_skb_head); |