litmus-rt.git/net/mac80211, branch wip-nested-locking

mac80211: fix TKIP replay vulnerability

2011-07-07T17:06:09+00:00

Unlike CCMP, the presence or absence of the QoS
field doesn't change the encryption, only the
TID is used. When no QoS field is present, zero
is used as the TID value. This means that it is
possible for an attacker to take a QoS packet
with TID 0 and replay it as a non-QoS packet.

Unfortunately, mac80211 uses different IVs for
checking the validity of the packet's TKIP IV
when it checks TID 0 and when it checks non-QoS
packets. This means it is vulnerable to this
replay attack.

To fix this, use the same replay counter for
TID 0 and non-QoS packets by overriding the
rx->queue value to 0 if it is 16 (non-QoS).

This is a minimal fix for now. I caused this
issue in

commit 1411f9b531f0a910cd1c85a337737c1e6ffbae6a
Author: Johannes Berg 
Date:   Thu Jul 10 10:11:02 2008 +0200

    mac80211: fix RX sequence number check

while fixing a sequence number issue (there,
a separate counter needs to be used).

Cc: stable@kernel.org
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: fix ie memory allocation for scheduled scans

2011-07-07T17:06:08+00:00

We were not allocating memory for the IEs passed in the scheduled_scan
request and this was causing memory corruption (buffer overflow).

Signed-off-by: Luciano Coelho 
Signed-off-by: John W. Linville

mac80211: fix rx->key NULL dereference during mic failure

2011-06-27T18:45:25+00:00

Sometimes when reporting a MIC failure rx->key may be unset. This
code path is hit when receiving a packet meant for a multicast
address, and decryption is performed in HW.

Fortunately, the failing key_idx is not used for anything up to
(and including) usermode, so we allow ourselves to drop it on the
way up when a key cannot be retrieved.

Signed-off-by: Arik Nemtsov 
Cc: stable@kernel.org
Signed-off-by: John W. Linville

mac80211: fix IBSS teardown race

2011-06-08T18:19:05+00:00

Ignacy reports that sometimes after leaving an IBSS
joining a new one didn't work because there still
were stations on the list. He fixed it by flushing
stations when attempting to join a new IBSS, but
this shouldn't be happening in the first case. When
I looked into it I saw a race condition in teardown
that could cause stations to be added after flush,
and thus cause this situation. Ignacy confirms that
after applying my patch he hasn't seen this happen
again.

Reported-by: Ignacy Gawedzki 
Debugged-by: Ignacy Gawedzki 
Tested-by: Ignacy Gawedzki 
Cc: stable@kernel.org
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

Revert "mac80211: stop queues before rate control updation"

2011-06-07T18:03:08+00:00

This reverts commit 1d38c16ce4156f63b45abbd09dd28ca2ef5172b4.

The mac80211 maintainer raised complaints about abuse of the CSA stop
reason, and about whether this patch actually serves its intended
purpose at all.

Signed-off-by: John W. Linville

Revert "mac80211: Skip tailroom reservation for full HW-crypto devices"

2011-06-06T19:23:53+00:00

This reverts commit aac6af5534fade2b18682a0b9efad1a6c04c34c6.

Conflicts:

	net/mac80211/key.c

That commit has a race that causes a warning, as documented in the thread
here:

	http://marc.info/?l=linux-wireless&m=130717684914101&w=2

Signed-off-by: John W. Linville

mac80211: call dev_alloc_name before copying name to sdata

2011-06-03T18:22:06+00:00

This partially reverts 1c5cae815d19ffe02bdfda1260949ef2b1806171, because
the netdev name is copied into sdata->name, which is used for debugging
messages, for example. Otherwise, we get messages like this:

wlan%d: authenticated

Signed-off-by: Thadeu Lima de Souza Cascardo 
Cc: Jiri Pirko 
Cc: David S. Miller 
Cc: Johannes Berg 
Cc: "John W. Linville" 
Signed-off-by: John W. Linville

Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

2011-05-27T19:18:35+00:00

mac80211: Remove duplicate linux/slab.h include from net/mac80211/scan.c

2011-05-27T16:53:47+00:00

Commit 79f460ca49d8d5700756ab7071c951311c7f29cc add a duplicate
linux/slab.h include to net/mac80211/scan.c - remove it.

Signed-off-by: Jesper Juhl 
Acked-by: Luciano Coelho 
Signed-off-by: John W. Linville

mac80211: clear local->ps_data on disassoc

2011-05-27T16:53:46+00:00

local->ps_data wasn't cleared on disassociation, which
(in some corner cases) caused reconnections to enter
psm before association completed.

Signed-off-by: Eliad Peller 
Signed-off-by: John W. Linville