linux-toradex.git/net/mac80211/wpa.c, branch v3.6.9

mac80211: check if key has TKIP type before updating IV

2012-10-31T17:10:19+00:00

commit 4045f72bcf3c293c7c5932ef001742d8bb5ded76 upstream.

This patch fix corruption which can manifest itself by following crash
when switching on rfkill switch with rt2x00 driver:
https://bugzilla.redhat.com/attachment.cgi?id=615362

Pointer key->u.ccmp.tfm of group key get corrupted in:

ieee80211_rx_h_michael_mic_verify():

        /* update IV in key information to be able to detect replays */
        rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
        rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;

because rt2x00 always set RX_FLAG_MMIC_STRIPPED, even if key is not TKIP.

We already check type of the key in different path in
ieee80211_rx_h_michael_mic_verify() function, so adding additional
check here is reasonable.

Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix network header location when adding encryption headers

2012-05-16T16:47:43+00:00

Update the location of the network header when adding encryption
specific headers to a skb. This allows low-level drivers to use the
(now correct) location of the network header.

Signed-off-by: Arik Nemtsov 
Signed-off-by: John W. Linville

mac80211: Add IV-room in the skb for TKIP and WEP

2012-05-16T16:46:37+00:00

Add IV-room in skb also for TKIP and WEP.
Extend patch: "mac80211: support adding IV-room in the skb for CCMP keys"

Signed-off-by: Janusz Dziedzic 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: linearize SKBs as needed for crypto

2012-03-13T18:54:17+00:00

Not linearizing every SKB will help actually pass
non-linear SKBs all the way up when on an encrypted
connection. For now, linearize TKIP completely as
it is lower performance and I don't quite grok all
the details.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: fix tx->skb NULL pointer dereference

2012-01-16T20:01:16+00:00

In function ieee80211_tx_h_encrypt the var info was
initialized from tx->skb, since the fucntion
is called after the function ieee80211_tx_h_fragment
tx->skb is not valid anymore.

Signed-off-by: Yoni Divinsky 
Signed-off-by: John W. Linville

mac80211: fix rx->key NULL pointer dereference in promiscuous mode

2012-01-11T20:14:50+00:00

Since:

commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
Author: Christian Lamparter 
Date:   Sat Apr 30 15:24:30 2011 +0200

    mac80211: consolidate MIC failure report handling

is possible to that we dereference rx->key == NULL when driver set
RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
promiscuous mode. This happen with rt73usb and rt61pci at least.

Before the commit we always check rx->key against NULL, so I assume
fix should be done in mac80211 (also mic_fail path has similar check).

References:
https://bugzilla.redhat.com/show_bug.cgi?id=769766
http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html

Cc: stable@vger.kernel.org # 3.0+
Reported-by: Stuart D Gathman 
Reported-by: Kai Wohlfahrt 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville

mac80211: use skb list for fragments

2011-11-21T21:20:42+00:00

We are currently linking the skbs by using skb->next
directly. This works, but the preferred way is to use
a struct sk_buff_head instead. That also prepares for
passing that to drivers directly.

While at it I noticed we calculate the duration for
fragments twice -- remove one of them.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: make sure hw_key exists before checking its flags

2011-11-11T17:32:51+00:00

Fixes a bug introduced in:

commit 077a9154898b374f20555adc3f620cccd02581d6
Author: Arik Nemtsov 
Date:   Sun Oct 23 08:21:41 2011 +0200

Reported-by: Arend van Spriel 
Reported-by: Johannes Berg 
Signed-off-by: Arik Nemtsov 
Signed-off-by: John W. Linville

mac80211: support adding IV-room in the skb for CCMP keys

2011-11-08T20:54:27+00:00

Some cards can generate CCMP IVs in HW, but require the space for the IV
to be pre-allocated in the frame at the correct offset. Add a key flag
that allows us to achieve this.

Signed-off-by: Arik Nemtsov 
Signed-off-by: John W. Linville

mac80211: move fragment flag to info flag as dont-fragment

2011-10-11T20:41:19+00:00

The purpose of this is two-fold:
 1) by moving it out of tx_data.flags, we can in
    another patch move the radiotap parsing so it
    no longer is in the hotpath
 2) if a device implements fragmentation but can
    optionally skip it, the radiotap request for
    not doing fragmentation may be honoured

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville