Commit 354e159d authored by Max Stepanov's avatar Max Stepanov Committed by Johannes Berg

mac80211: check pairwise key_idx on get_key call

Verify that a pairwise key index value on ieee80211_get_key call
doesn't exceed the boundaries of the pairwise key array.
Signed-off-by: default avatarMax Stepanov <Max.Stepanov@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent dddd586b
...@@ -301,9 +301,9 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev, ...@@ -301,9 +301,9 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
if (!sta) if (!sta)
goto out; goto out;
if (pairwise) if (pairwise && key_idx < NUM_DEFAULT_KEYS)
key = rcu_dereference(sta->ptk[key_idx]); key = rcu_dereference(sta->ptk[key_idx]);
else if (key_idx < NUM_DEFAULT_KEYS) else if (!pairwise && key_idx < NUM_DEFAULT_KEYS)
key = rcu_dereference(sta->gtk[key_idx]); key = rcu_dereference(sta->gtk[key_idx]);
} else } else
key = rcu_dereference(sdata->keys[key_idx]); key = rcu_dereference(sdata->keys[key_idx]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment