Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f09c2563 authored by Stanislaw Gruszka's avatar Stanislaw Gruszka Committed by John W. Linville
Browse files

airo: fix setting zero length WEP key 



Patch prevents call set_wep_key() with zero key length. That fix long
standing regression since commit c0380693
"airo: clean up WEP key operations". Additionally print call trace when
someone will try to use improper parameters, and remove key.len = 0
assignment, because it is in not possible code path.

Reported-by: default avatarChris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
Bisected-by: default avatarChris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
Tested-by: default avatarChris Siebenmann <cks@cs.toronto.edu>
Cc: Dan Williams <dcbw@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: default avatarStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 299af9d3

drivers/net/wireless/airo.c

+18 −16
Original line number Diff line number Diff line
@@ -5254,11 +5254,7 @@ static int set_wep_key(struct airo_info *ai, u16 index, const char *key, 
	WepKeyRid wkr;

	int rc;



	if (keylen == 0) {

		airo_print_err(ai->dev->name, "%s: key length to set was zero",

			       __func__);

		return -1;

	}

	WARN_ON(keylen == 0);



	memset(&wkr, 0, sizeof(wkr));

	wkr.len = cpu_to_le16(sizeof(wkr));
@@ -6405,11 +6401,7 @@ static int airo_set_encode(struct net_device *dev, 
		if (dwrq->length > MIN_KEY_SIZE)

			key.len = MAX_KEY_SIZE;

		else

			if (dwrq->length > 0)

			key.len = MIN_KEY_SIZE;

			else

				/* Disable the key */

				key.len = 0;

		/* Check if the key is not marked as invalid */

		if(!(dwrq->flags & IW_ENCODE_NOKEY)) {

			/* Cleanup */
@@ -6590,14 +6582,24 @@ static int airo_set_encodeext(struct net_device *dev, 
		default:

			return -EINVAL;

		}

		/* Send the key to the card */

		if (key.len == 0) {

			rc = set_wep_tx_idx(local, idx, perm, 1);

			if (rc < 0) {

				airo_print_err(local->dev->name,

					       "failed to set WEP transmit index to %d: %d.",

					       idx, rc);

				return rc;

			}

		} else {

			rc = set_wep_key(local, idx, key.key, key.len, perm, 1);

			if (rc < 0) {

			airo_print_err(local->dev->name, "failed to set WEP key"

			               " at index %d: %d.", idx, rc);

				airo_print_err(local->dev->name,

					       "failed to set WEP key at index %d: %d.",

					       idx, rc);

				return rc;

			}

		}

	}



	/* Read the flags */

	if(encoding->flags & IW_ENCODE_DISABLED)