mac80211: fix rx->key NULL dereference during mic failure

Sometimes when reporting a MIC failure rx->key may be unset. This
code path is hit when receiving a packet meant for a multicast
address, and decryption is performed in HW.

Fortunately, the failing key_idx is not used for anything up to
(and including) usermode, so we allow ourselves to drop it on the
way up when a key cannot be retrieved.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Cc: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 98fa8eb6cc4b..f07602d7bf68 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6463,7 +6463,8 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
         if (addr)
                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
-        NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
+        if (key_id != -1)
+                NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
         if (tsc)
                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);