summaryrefslogtreecommitdiffstats
path: root/net/mac80211
diff options
context:
space:
mode:
authorMax Stepanov <Max.Stepanov@intel.com>2013-12-08 13:30:52 +0200
committerJohannes Berg <johannes.berg@intel.com>2013-12-16 15:10:10 +0100
commit354e159d8c9970969873d66a789d3ac4528c44ff (patch)
treee4952fce57368a9dbc3b56861643d8d091b7a0f7 /net/mac80211
parentdddd586bee9325e890a671f8e24ae39418338295 (diff)
downloadop-kernel-dev-354e159d8c9970969873d66a789d3ac4528c44ff.zip
op-kernel-dev-354e159d8c9970969873d66a789d3ac4528c44ff.tar.gz
mac80211: check pairwise key_idx on get_key call
Verify that a pairwise key index value on ieee80211_get_key call doesn't exceed the boundaries of the pairwise key array. Signed-off-by: Max Stepanov <Max.Stepanov@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211')
-rw-r--r--net/mac80211/cfg.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 35bb71b..0962c77 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -301,9 +301,9 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
if (!sta)
goto out;
- if (pairwise)
+ if (pairwise && key_idx < NUM_DEFAULT_KEYS)
key = rcu_dereference(sta->ptk[key_idx]);
- else if (key_idx < NUM_DEFAULT_KEYS)
+ else if (!pairwise && key_idx < NUM_DEFAULT_KEYS)
key = rcu_dereference(sta->gtk[key_idx]);
} else
key = rcu_dereference(sdata->keys[key_idx]);
OpenPOWER on IntegriCloud