diff options
| author | John W. Linville <linville@tuxdriver.com> | 2014-11-10 19:08:45 +0100 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2014-11-10 19:08:45 +0100 |
| commit | 6168823518d8e5bd03615ffe5a6f0b2fe3e76efc (patch) | |
| tree | 57d1975e4e9229446cf040bc954a9484b804c3c6 | |
| parent | Merge tag 'mac80211-for-john-2014-11-04' of git://git.kernel.org/pub/scm/linu... (diff) | |
| parent | mac80211: Fix regression that triggers a kernel BUG with CCMP (diff) | |
| download | linux-6168823518d8e5bd03615ffe5a6f0b2fe3e76efc.tar.xz linux-6168823518d8e5bd03615ffe5a6f0b2fe3e76efc.zip | |
Merge tag 'mac80211-for-john-2014-11-10' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
Johannes Berg <johannes@sipsolutions.net> says:
"This has just one fix, for an issue with the CCMP decryption
that can cause a kernel crash. I'm not sure it's remotely
exploitable, but it's an important fix nonetheless."
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | net/mac80211/aes_ccm.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c index ec24378caaaf..09d9caaec591 100644 --- a/net/mac80211/aes_ccm.c +++ b/net/mac80211/aes_ccm.c @@ -53,6 +53,9 @@ int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, __aligned(__alignof__(struct aead_request)); struct aead_request *aead_req = (void *) aead_req_data; + if (data_len == 0) + return -EINVAL; + memset(aead_req, 0, sizeof(aead_req_data)); sg_init_one(&pt, data, data_len); |