Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757783Ab0GASXN (ORCPT ); Thu, 1 Jul 2010 14:23:13 -0400 Received: from kroah.org ([198.145.64.141]:35475 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757711Ab0GASXG (ORCPT ); Thu, 1 Jul 2010 14:23:06 -0400 X-Mailbox-Line: From gregkh@clark.site Thu Jul 1 10:32:10 2010 Message-Id: <20100701173210.258796794@clark.site> User-Agent: quilt/0.48-10.1 Date: Thu, 01 Jul 2010 10:31:07 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Jouni Malinen , "John W. Linville" Subject: [patch 041/149] mac80211: Fix robust management frame handling (MFP) In-Reply-To: <20100701175144.GA2116@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1478 Lines: 41 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jouni Malinen commit d211e90e28a074447584729018a39910d691d1a8 upstream. Commit e34e09401ee9888dd662b2fca5d607794a56daf2 incorrectly removed use of ieee80211_has_protected() from the management frame case and in practice, made this validation drop all Action frames when MFP is enabled. This should have only been done for frames with Protected field set to zero. Signed-off-by: Jouni Malinen Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman --- net/mac80211/rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1220,7 +1220,8 @@ ieee80211_drop_unencrypted(struct ieee80 (rx->key || rx->sdata->drop_unencrypted))) return -EACCES; if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) { - if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && + if (unlikely(!ieee80211_has_protected(fc) && + ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && rx->key)) return -EACCES; /* BIP does not use Protected field, so need to check MMIE */ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/