mac80211: fix rx->key NULL pointer dereference in promiscuous mode
authorStanislaw Gruszka <sgruszka@redhat.com>
Wed, 11 Jan 2012 08:26:54 +0000 (09:26 +0100)
committerGreg Kroah-Hartman <gregkh@suse.de>
Wed, 18 Jan 2012 15:31:58 +0000 (07:31 -0800)
commitc877bca3e2a5ded480a824c1999d0eb526a29f2a
treebc997f313cca5e620eafa4506e334764a8a49b68
parent7eff19fee7a5c461a1bc0a6306bb05adb53051c7
mac80211: fix rx->key NULL pointer dereference in promiscuous mode

commit 1140afa862842ac3e56678693050760edc4ecde9 upstream.

Since:

commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
Author: Christian Lamparter <chunkeey@googlemail.com>
Date:   Sat Apr 30 15:24:30 2011 +0200

    mac80211: consolidate MIC failure report handling

is possible to that we dereference rx->key == NULL when driver set
RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
promiscuous mode. This happen with rt73usb and rt61pci at least.

Before the commit we always check rx->key against NULL, so I assume
fix should be done in mac80211 (also mic_fail path has similar check).

References:
https://bugzilla.redhat.com/show_bug.cgi?id=769766
http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html

Reported-by: Stuart D Gathman <stuart@gathman.org>
Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
net/mac80211/wpa.c