Commit 2ab87d5d authored by Xinming Hu's avatar Xinming Hu Committed by Kalle Valo

mwifiex: do not send key material cmd when delete wep key

This patch fixes memory corruption reported by community developer.

"Memory corruption occurs in mwifiex_ret_802_11_key_material_v1()
when a short command response is received without a key length
causing non initialised memory to be interpreted as the key
length resulting in a memcpy() overwriting the part of the
driver's private data structure beyond the key area."

For v1 key material API firmwares, there is no need to send
command to delete WEP key. WEP encryption/decryption is controlled
by mac_control command.

This patch avoids sending key material command in del_key case.
Reported-by: default avatarMartin Fuzzey <mfuzzey@parkeon.com>
Signed-off-by: default avatarXinming Hu <huxm@marvell.com>
Signed-off-by: default avatarCathy Luo <cluo@marvell.com>
Signed-off-by: default avatarAvinash Patil <patila@marvell.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent bd7d0d10
...@@ -902,9 +902,12 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv, ...@@ -902,9 +902,12 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
if (wep_key->key_length) { if (wep_key->key_length) {
void *enc_key; void *enc_key;
if (encrypt_key->key_disable) if (encrypt_key->key_disable) {
memset(&priv->wep_key[index], 0, memset(&priv->wep_key[index], 0,
sizeof(struct mwifiex_wep_key)); sizeof(struct mwifiex_wep_key));
if (wep_key->key_length)
goto done;
}
if (adapter->key_api_major_ver == KEY_API_VER_MAJOR_V2) if (adapter->key_api_major_ver == KEY_API_VER_MAJOR_V2)
enc_key = encrypt_key; enc_key = encrypt_key;
...@@ -918,6 +921,7 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv, ...@@ -918,6 +921,7 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
return ret; return ret;
} }
done:
if (priv->sec_info.wep_enabled) if (priv->sec_info.wep_enabled)
priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE; priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
else else
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment