Commit 8f7d99ba authored by Johannes Berg's avatar Johannes Berg

cfg80211: wext: really don't store non-WEP keys

Jouni reported that during (repeated) wext_pmf test runs (from the
wpa_supplicant hwsim test suite) the kernel crashes. The reason is
that after the key is set, the wext code still unnecessarily stores
it into the key cache. Despite smatch pointing out an overflow, I
failed to identify the possibility for this in the code and missed
it during development of the earlier patch series.

In order to fix this, simply check that we never store anything but
WEP keys into the cache, adding a comment as to why that's enough.

Also, since the cache is still allocated early even if it won't be
used in many cases, add a comment explaining why - otherwise we'd
have to roll back key settings to the driver in case of allocation
failures, which is far more difficult.

Fixes: 89b706fb ("cfg80211: reduce connect key caching struct size")
Reported-by: default avatarJouni Malinen <j@w1.fi>
Bisected-by: default avatarJouni Malinen <j@w1.fi>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 8564e382
...@@ -406,6 +406,10 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev, ...@@ -406,6 +406,10 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
if (pairwise && !addr) if (pairwise && !addr)
return -EINVAL; return -EINVAL;
/*
* In many cases we won't actually need this, but it's better
* to do it first in case the allocation fails. Don't use wext.
*/
if (!wdev->wext.keys) { if (!wdev->wext.keys) {
wdev->wext.keys = kzalloc(sizeof(*wdev->wext.keys), wdev->wext.keys = kzalloc(sizeof(*wdev->wext.keys),
GFP_KERNEL); GFP_KERNEL);
...@@ -493,7 +497,13 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev, ...@@ -493,7 +497,13 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
if (err) if (err)
return err; return err;
if (!addr) { /*
* We only need to store WEP keys, since they're the only keys that
* can be be set before a connection is established and persist after
* disconnecting.
*/
if (!addr && (params->cipher == WLAN_CIPHER_SUITE_WEP40 ||
params->cipher == WLAN_CIPHER_SUITE_WEP104)) {
wdev->wext.keys->params[idx] = *params; wdev->wext.keys->params[idx] = *params;
memcpy(wdev->wext.keys->data[idx], memcpy(wdev->wext.keys->data[idx],
params->key, params->key_len); params->key, params->key_len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment