diff options
| author | Max Stepanov <Max.Stepanov@intel.com> | 2013-12-08 13:30:52 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2013-12-16 15:10:10 +0100 |
| commit | 354e159d8c9970969873d66a789d3ac4528c44ff (patch) | |
| tree | e4952fce57368a9dbc3b56861643d8d091b7a0f7 | |
| parent | dddd586bee9325e890a671f8e24ae39418338295 (diff) | |
mac80211: check pairwise key_idx on get_key call
Verify that a pairwise key index value on ieee80211_get_key call
doesn't exceed the boundaries of the pairwise key array.
Signed-off-by: Max Stepanov <Max.Stepanov@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/cfg.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 35bb71be72b..0962c77f013 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -301,9 +301,9 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev, if (!sta) goto out; - if (pairwise) + if (pairwise && key_idx < NUM_DEFAULT_KEYS) key = rcu_dereference(sta->ptk[key_idx]); - else if (key_idx < NUM_DEFAULT_KEYS) + else if (!pairwise && key_idx < NUM_DEFAULT_KEYS) key = rcu_dereference(sta->gtk[key_idx]); } else key = rcu_dereference(sdata->keys[key_idx]); |