aboutsummaryrefslogtreecommitdiffstats
path: root/net/mac80211/debugfs_key.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2011-07-06 16:00:35 -0400
committerJohn W. Linville <linville@tuxdriver.com>2011-07-08 11:11:20 -0400
commit75396ae6d433b49482e377e6f8dbf1f42ad53f3a (patch)
tree07fb506f08f3cca7d67d2fd365cc059240b6957b /net/mac80211/debugfs_key.c
parentaba83a0b301c32dbb91c017f33307611e1a1d384 (diff)
mac80211: fix CMAC races
Just like TKIP and CCMP, CMAC has the PN race. It might not actually be possible to hit it now since there aren't multiple ACs for management frames, but fix it anyway. Also move scratch buffers onto the stack. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/debugfs_key.c')
-rw-r--r--net/mac80211/debugfs_key.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 4433760db4c7..38e6101190d9 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -78,7 +78,6 @@ KEY_OPS(algorithm);
78static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf, 78static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
79 size_t count, loff_t *ppos) 79 size_t count, loff_t *ppos)
80{ 80{
81 const u8 *tpn;
82 u64 pn; 81 u64 pn;
83 char buf[20]; 82 char buf[20];
84 int len; 83 int len;
@@ -101,10 +100,10 @@ static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
101 (u8)(pn >> 16), (u8)(pn >> 8), (u8)pn); 100 (u8)(pn >> 16), (u8)(pn >> 8), (u8)pn);
102 break; 101 break;
103 case WLAN_CIPHER_SUITE_AES_CMAC: 102 case WLAN_CIPHER_SUITE_AES_CMAC:
104 tpn = key->u.aes_cmac.tx_pn; 103 pn = atomic64_read(&key->u.aes_cmac.tx_pn);
105 len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n", 104 len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
106 tpn[0], tpn[1], tpn[2], tpn[3], tpn[4], 105 (u8)(pn >> 40), (u8)(pn >> 32), (u8)(pn >> 24),
107 tpn[5]); 106 (u8)(pn >> 16), (u8)(pn >> 8), (u8)pn);
108 break; 107 break;
109 default: 108 default:
110 return 0; 109 return 0;