Return-path: Received: from mx0a-0016f401.pphosted.com ([67.231.148.174]:29147 "EHLO mx0a-0016f401.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751692AbaLQI1u (ORCPT ); Wed, 17 Dec 2014 03:27:50 -0500 From: Avinash Patil To: CC: , , , , , Avinash Patil Subject: [PATCH 2/4] mwifiex: do not send key material cmd when delete wep key Date: Wed, 17 Dec 2014 19:26:59 +0530 Message-ID: <1418824621-2102-2-git-send-email-patila@marvell.com> (sfid-20141217_092752_660797_25D54354) In-Reply-To: <1418824621-2102-1-git-send-email-patila@marvell.com> References: <1418824621-2102-1-git-send-email-patila@marvell.com> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-wireless-owner@vger.kernel.org List-ID: From: Xinming Hu This patch fixes memory corruption reported by community developer. "Memory corruption occurs in mwifiex_ret_802_11_key_material_v1() when a short command response is received without a key length causing non initialised memory to be interpreted as the key length resulting in a memcpy() overwriting the part of the driver's private data structure beyond the key area." For v1 key material API firmwares, there is no need to send command to delete WEP key. WEP encryption/decryption is controlled by mac_control command. This patch avoids sending key material command in del_key case. Reported-by: Martin Fuzzey Signed-off-by: Xinming Hu Signed-off-by: Cathy Luo Signed-off-by: Avinash Patil --- drivers/net/wireless/mwifiex/sta_ioctl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c index 1626868..fb9c5fc 100644 --- a/drivers/net/wireless/mwifiex/sta_ioctl.c +++ b/drivers/net/wireless/mwifiex/sta_ioctl.c @@ -902,9 +902,12 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv, if (wep_key->key_length) { void *enc_key; - if (encrypt_key->key_disable) + if (encrypt_key->key_disable) { memset(&priv->wep_key[index], 0, sizeof(struct mwifiex_wep_key)); + if (wep_key->key_length) + goto done; + } if (adapter->key_api_major_ver == KEY_API_VER_MAJOR_V2) enc_key = encrypt_key; @@ -918,6 +921,7 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv, return ret; } +done: if (priv->sec_info.wep_enabled) priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE; else -- 1.8.1.4