mac80211: Use a separate CCMP PN receive counter for management frames

When management frame protection (IEEE 802.11w) is used, we must use a
separate counter for tracking received CCMP packet number for the
management frames. The previously used NUM_RX_DATA_QUEUESth queue was
shared with data frames when QoS was not used and that can cause
problems in detecting replays incorrectly for robust management frames.
Add a new counter just for robust management frames to avoid this issue.

Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 9996e3be6e63..a3849fa3fce8 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -77,7 +77,13 @@ struct ieee80211_key {
                 } tkip;
                 struct {
                         u8 tx_pn[6];
-                        u8 rx_pn[NUM_RX_DATA_QUEUES][6];
+                        /*
+                         * Last received packet number. The first
+                         * NUM_RX_DATA_QUEUES counters are used with Data
+                         * frames and the last counter is used with Robust
+                         * Management frames.
+                         */
+                        u8 rx_pn[NUM_RX_DATA_QUEUES + 1][6];
                         struct crypto_cipher *tfm;
                         u32 replays; /* dot11RSNAStatsCCMPReplays */
                         /* scratch buffers for virt_to_page() (crypto API) */