path: root/net
diff options
authorStanislaw Gruszka <>2012-01-11 09:26:54 +0100
committerGreg Kroah-Hartman <>2012-01-18 07:31:58 -0800
commitc877bca3e2a5ded480a824c1999d0eb526a29f2a (patch)
treebc997f313cca5e620eafa4506e334764a8a49b68 /net
parent7eff19fee7a5c461a1bc0a6306bb05adb53051c7 (diff)
mac80211: fix rx->key NULL pointer dereference in promiscuous mode
commit 1140afa862842ac3e56678693050760edc4ecde9 upstream. Since: commit 816c04fe7ef01dd9649f5ccfe796474db8708be5 Author: Christian Lamparter <> Date: Sat Apr 30 15:24:30 2011 +0200 mac80211: consolidate MIC failure report handling is possible to that we dereference rx->key == NULL when driver set RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in promiscuous mode. This happen with rt73usb and rt61pci at least. Before the commit we always check rx->key against NULL, so I assume fix should be done in mac80211 (also mic_fail path has similar check). References: Reported-by: Stuart D Gathman <> Reported-by: Kai Wohlfahrt <> Signed-off-by: Stanislaw Gruszka <> Signed-off-by: John W. Linville <> Signed-off-by: Greg Kroah-Hartman <>
Diffstat (limited to 'net')
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 7bc8702808fa..ea70837e9d80 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -105,7 +105,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
if (status->flag & RX_FLAG_MMIC_ERROR)
goto mic_fail;
- if (!(status->flag & RX_FLAG_IV_STRIPPED))
+ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
goto update_iv;