Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 54ec4c41 authored by Davis Mosenkovs's avatar Davis Mosenkovs Committed by Greg Kroah-Hartman
Browse files

mac80211: fix memory corruption in EAPOL handling 

Commit e3d4030498c3 ("mac80211: do not accept/forward invalid EAPOL
frames") uses skb_mac_header() before eth_type_trans() is called
leading to incorrect pointer, the pointer gets written to. This issue
has appeared during backporting to 4.4, 4.9 and 4.14.

Fixes: e3d4030498c3 ("mac80211: do not accept/forward invalid EAPOL frames")
Link: https://lore.kernel.org/r/CAHQn7pKcyC_jYmGyTcPCdk9xxATwW5QPNph=bsZV8d-HPwNsyA@mail.gmail.com


Cc: <stable@vger.kernel.org> # 4.4.x
Signed-off-by: default avatarDavis Mosenkovs <davis@mosenkovs.lv>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 545914a9

net/mac80211/rx.c

+1 −1
Original line number Diff line number Diff line
@@ -2380,7 +2380,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 
#endif



	if (skb) {

		struct ethhdr *ehdr = (void *)skb_mac_header(skb);

		struct ethhdr *ehdr = (struct ethhdr *)skb->data;



		/* deliver to local stack */

		skb->protocol = eth_type_trans(skb, dev);