Commit 1007d143 authored May 11, 2015 by Janusz Dziedzic Committed by Sasha Levin Jun 10, 2015

mac80211: move WEP tailroom size check



[ Upstream commit 47b4e1fc4972cc43a19121bc2608a60aef3bf216 ]

Remove checking tailroom when adding IV as it uses only
headroom, and move the check to the ICV generation that
actually needs the tailroom.

In other case I hit such warning and datapath don't work,
when testing:
- IBSS + WEP
- ath9k with hw crypt enabled
- IPv6 data (ping6)

WARNING: CPU: 3 PID: 13301 at net/mac80211/wep.c:102 ieee80211_wep_add_iv+0x129/0x190 [mac80211]()
[...]
Call Trace:
[<ffffffff817bf491>] dump_stack+0x45/0x57
[<ffffffff8107746a>] warn_slowpath_common+0x8a/0xc0
[<ffffffff8107755a>] warn_slowpath_null+0x1a/0x20
[<ffffffffc09ae109>] ieee80211_wep_add_iv+0x129/0x190 [mac80211]
[<ffffffffc09ae7ab>] ieee80211_crypto_wep_encrypt+0x6b/0xd0 [mac80211]
[<ffffffffc09d3fb1>] invoke_tx_handlers+0xc51/0xf30 [mac80211]
[...]

Cc: stable@vger.kernel.org
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

parent f09aa7ad

net/mac80211/wep.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -98,8 +98,7 @@ static u8 ieee80211_wep_add_iv(struct ieee80211_local local,

		hdr->frame_control \|= cpu_to_le16(IEEE80211_FCTL_PROTECTED);

		if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN \|\|
		skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
		if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
		return NULL;

		hdrlen = ieee80211_hdrlen(hdr->frame_control);
		@@ -169,6 +168,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
		size_t len;
		u8 rc4key[3 + WLAN_KEY_LEN_WEP104];

		if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN))
		return -1;

		iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
		if (!iv)
		return -1;