Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 354e159d authored Dec 08, 2013 by Max Stepanov Committed by Johannes Berg Dec 16, 2013

mac80211: check pairwise key_idx on get_key call



Verify that a pairwise key index value on ieee80211_get_key call
doesn't exceed the boundaries of the pairwise key array.

Signed-off-by: Max Stepanov <Max.Stepanov@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent dddd586b

net/mac80211/cfg.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -301,9 +301,9 @@ static int ieee80211_get_key(struct wiphy wiphy, struct net_device dev,
		if (!sta)
		goto out;

		if (pairwise)
		if (pairwise && key_idx < NUM_DEFAULT_KEYS)
		key = rcu_dereference(sta->ptk[key_idx]);
		else if (key_idx < NUM_DEFAULT_KEYS)
		else if (!pairwise && key_idx < NUM_DEFAULT_KEYS)
		key = rcu_dereference(sta->gtk[key_idx]);
		} else
		key = rcu_dereference(sdata->keys[key_idx]);