diff options
| author | David S. Miller <davem@davemloft.net> | 2012-10-21 20:57:37 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-10-21 20:57:37 -0400 |
| commit | e6e71054cd9f98c8ebb3a5f66f2776a9736afc87 (patch) | |
| tree | bdbfa01832b970f550170fd2a28042e3def18d85 /net/mac80211/wpa.c | |
| parent | 9a4da2cd99e4edfee1e48c5e2b4928eaefb56006 (diff) | |
| parent | 06f40a41b80e25e88a2b612ea3b2a94f93c94f72 (diff) | |
| download | linux-e6e71054cd9f98c8ebb3a5f66f2776a9736afc87.tar.gz linux-e6e71054cd9f98c8ebb3a5f66f2776a9736afc87.tar.bz2 linux-e6e71054cd9f98c8ebb3a5f66f2776a9736afc87.zip | |
Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
John W. Linville says:
====================
This is a batch of fixes intended for the 3.7 stream.
Dan Carpenter brings a fix for a simple signedness bug that could
prevent the proper termination of a loop.
Felix Fietkau found a few more places that need to use
ieee80211_free_txskb for properly releasing SKBs used by mac80211.
Franky Lin offers a pair of brcmfmac fixes, both fixing simple state
reporting errors.
Hante Meuleman corrects an error reporting case that wasn't handling
all types of errors properly.
Johan Hedberg offers a fix for an issue discovered at the Bluetooth
UnPlug Fest. Gustavo says "the patch fixes a failure to pair with
devices that support the LE Secure Connections feature."
Johannes Berg sends an iwlwifi fix to handle a message type that
is too large for the normal command mechanism. He also provides a
mac80211 fix to use HT20 channels when HT40 channels are not permitted.
Jouni Malinen offers a mac80211 fix for a masking error that was
incorrectly marking some frames.
Piotr Haber provides a fix to make sure bcma devices are unregistered
properly.
Stanislav Yakovlev gives us a fix for a panic in the ipw2200 driver.
Stanislaw Gruszka sends a pair of fixes: one prevents a mismatch on
connection states between cfg80211 and mac80211; the other prevents
some frame corruption related to handling encryption.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mac80211/wpa.c')
| -rw-r--r-- | net/mac80211/wpa.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c index bdb53aba888e..8bd2f5c6a56e 100644 --- a/net/mac80211/wpa.c +++ b/net/mac80211/wpa.c @@ -106,7 +106,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) if (status->flag & RX_FLAG_MMIC_ERROR) goto mic_fail; - if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key) + if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key && + rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP) goto update_iv; return RX_CONTINUE; @@ -545,14 +546,19 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx) static void bip_aad(struct sk_buff *skb, u8 *aad) { + __le16 mask_fc; + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; + /* BIP AAD: FC(masked) || A1 || A2 || A3 */ /* FC type/subtype */ - aad[0] = skb->data[0]; /* Mask FC Retry, PwrMgt, MoreData flags to zero */ - aad[1] = skb->data[1] & ~(BIT(4) | BIT(5) | BIT(6)); + mask_fc = hdr->frame_control; + mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM | + IEEE80211_FCTL_MOREDATA); + put_unaligned(mask_fc, (__le16 *) &aad[0]); /* A1 || A2 || A3 */ - memcpy(aad + 2, skb->data + 4, 3 * ETH_ALEN); + memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN); } |