mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
57 lines
2.0 KiB
Diff
57 lines
2.0 KiB
Diff
|
From c7b18cdf1887e8ce91e04342cfd2d8fe1630be92 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Johannes Berg <johannes.berg@intel.com>
|
||
|
|
Date: Sat, 1 Feb 2014 00:16:23 +0100
|
||
|
|
Subject: mac80211: fix fragmentation code, particularly for encryption
|
||
|
|
|
||
|
|
commit 338f977f4eb441e69bb9a46eaa0ac715c931a67f upstream.
|
||
|
|
|
||
|
|
The "new" fragmentation code (since my rewrite almost 5 years ago)
|
||
|
|
erroneously sets skb->len rather than using skb_trim() to adjust
|
||
|
|
the length of the first fragment after copying out all the others.
|
||
|
|
This leaves the skb tail pointer pointing to after where the data
|
||
|
|
originally ended, and thus causes the encryption MIC to be written
|
||
|
|
at that point, rather than where it belongs: immediately after the
|
||
|
|
data.
|
||
|
|
|
||
|
|
The impact of this is that if software encryption is done, then
|
||
|
|
a) encryption doesn't work for the first fragment, the connection
|
||
|
|
becomes unusable as the first fragment will never be properly
|
||
|
|
verified at the receiver, the MIC is practically guaranteed to
|
||
|
|
be wrong
|
||
|
|
b) we leak up to 8 bytes of plaintext (!) of the packet out into
|
||
|
|
the air
|
||
|
|
|
||
|
|
This is only mitigated by the fact that many devices are capable
|
||
|
|
of doing encryption in hardware, in which case this can't happen
|
||
|
|
as the tail pointer is irrelevant in that case. Additionally,
|
||
|
|
fragmentation is not used very frequently and would normally have
|
||
|
|
to be configured manually.
|
||
|
|
|
||
|
|
Fix this by using skb_trim() properly.
|
||
|
|
|
||
|
|
Fixes: 2de8e0d999b8 ("mac80211: rewrite fragmentation")
|
||
|
|
Reported-by: Jouni Malinen <j@w1.fi>
|
||
|
|
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||
|
|
[bwh: Backported to 3.2: adjust context]
|
||
|
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||
|
|
---
|
||
|
|
net/mac80211/tx.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
|
||
|
|
index 4ff35bf..5186f8b 100644
|
||
|
|
--- a/net/mac80211/tx.c
|
||
|
|
+++ b/net/mac80211/tx.c
|
||
|
|
@@ -884,7 +884,7 @@ static int ieee80211_fragment(struct ieee80211_local *local,
|
||
|
|
pos += fraglen;
|
||
|
|
}
|
||
|
|
|
||
|
|
- skb->len = hdrlen + per_fragm;
|
||
|
|
+ skb_trim(skb, hdrlen + per_fragm);
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|