diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2023-03-01 11:09:16 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2023-03-07 10:29:53 +0100 |
| commit | 3ffcc659dc6fa84da7db57f56fd48756c5a60fba (patch) | |
| tree | 5e886ac8c37f4cdb8cbe177727a25e20cee8c326 /net/mac80211/tx.c | |
| parent | wifi: mac80211: clear all bits that relate rtap fields on skb (diff) | |
| download | linux-3ffcc659dc6fa84da7db57f56fd48756c5a60fba.tar.xz linux-3ffcc659dc6fa84da7db57f56fd48756c5a60fba.zip | |
wifi: mac80211: check key taint for beacon protection
This will likely never happen, but for completeness check
the key taint flag before using a key for beacon protection.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230301115906.cf2c3fee6f1f.I2f19b3e04e31c99bed3c9dc71935bf513b2cd177@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to '')
| -rw-r--r-- | net/mac80211/tx.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 7699fb410670..1f9294f5baa4 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -5115,6 +5115,12 @@ static int ieee80211_beacon_protect(struct sk_buff *skb, tx.key = rcu_dereference(link->default_beacon_key); if (!tx.key) return 0; + + if (unlikely(tx.key->flags & KEY_FLAG_TAINTED)) { + tx.key = NULL; + return -EINVAL; + } + tx.local = local; tx.sdata = sdata; __skb_queue_head_init(&tx.skbs); |