[kernel/f15] Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766)
Josh Boyer
jwboyer at fedoraproject.org
Wed Jan 11 16:17:42 UTC 2012
commit dc54a7e0f4ffa5ef8ef64538a859125d18b1941c
Author: Josh Boyer <jwboyer at redhat.com>
Date: Wed Jan 11 11:12:31 2012 -0500
Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766)
kernel.spec | 10 ++++-
...rx-key-NULL-ptr-deref-in-promiscuous-mode.patch | 47 ++++++++++++++++++++
2 files changed, 56 insertions(+), 1 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index be37077..1ed63ff 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -42,7 +42,7 @@ Summary: The Linux kernel
# When changing real_sublevel below, reset this by hand to 1
# (or to 0 and then use rpmdev-bumpspec).
#
-%global baserelease 1
+%global baserelease 2
%global fedora_build %{baserelease}
# real_sublevel is the 3.x kernel version we're starting with
@@ -734,6 +734,9 @@ Patch21065: Bluetooth-Add-support-for-BCM20702A0.patch
Patch21071: ext4-Fix-error-handling-on-inode-bitmap-corruption.patch
Patch21072: ext3-Fix-error-handling-on-inode-bitmap-corruption.patch
+#rhbz 769766
+Patch21073: mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
+
%endif
BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1362,6 +1365,8 @@ ApplyPatch KVM-fix-device-assignment-permissions.patch
ApplyPatch ext4-Fix-error-handling-on-inode-bitmap-corruption.patch
ApplyPatch ext3-Fix-error-handling-on-inode-bitmap-corruption.patch
+ApplyPatch mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -2009,6 +2014,9 @@ fi
# and build.
%changelog
+* Wed Jan 11 2012 Josh Boyer <jwboyer at redhat.com>
+- Patch from Stanislaw Gruszka to fix NULL ptr deref in mac80211 (rhbz 769766)
+
* Tue Jan 10 2012 Josh Boyer <jwboyer at redhat.com>
- Fix ext3/ext4 corrupted bitmap error path (pointed out by Eric Sandeen)
diff --git a/mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch b/mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
new file mode 100644
index 0000000..abacee6
--- /dev/null
+++ b/mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
@@ -0,0 +1,47 @@
+Since:
+
+commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
+Author: Christian Lamparter <chunkeey at googlemail.com>
+Date: Sat Apr 30 15:24:30 2011 +0200
+
+ mac80211: consolidate MIC failure report handling
+
+is possible to that we dereference rx->key == NULL when driver set
+RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
+promiscuous mode. This happen with rt73usb and rt61pci at least.
+
+Before the commit we always check rx->key against NULL, so I assume
+fix should be done in mac80211 (also mic_fail path has similar check).
+
+References:
+https://bugzilla.redhat.com/show_bug.cgi?id=769766
+http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html
+
+Cc: stable at vger.kernel.org # 3.0+
+Reported-by: Stuart D Gathman <stuart at gathman.org>
+Reported-by: Kai Wohlfahrt <kai.scorpio at gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
+---
+ net/mac80211/wpa.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index 93aab07..422b798 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -106,7 +106,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
+ if (status->flag & RX_FLAG_MMIC_ERROR)
+ goto mic_fail;
+
+- if (!(status->flag & RX_FLAG_IV_STRIPPED))
++ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
+ goto update_iv;
+
+ return RX_CONTINUE;
+--
+1.7.1
+
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
\ No newline at end of file
More information about the scm-commits
mailing list