aboutsummaryrefslogtreecommitdiffstats
path: root/package/kernel/mac80211/patches
diff options
context:
space:
mode:
Diffstat (limited to 'package/kernel/mac80211/patches')
-rw-r--r--package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch48
1 files changed, 48 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch b/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch
new file mode 100644
index 0000000000..1c1951eadd
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch
@@ -0,0 +1,48 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 28 Jan 2019 13:16:45 +0100
+Subject: [PATCH] mac80211: ensure that management tx skbs have encryption
+ tailroom
+
+Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management
+frames need to be software encrypted. Since normal data packets are still
+encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented
+after key upload. This can lead to passing skbs to ccmp_encrypt_skb, which
+don't have the needed tailroom for software encryption.
+
+Change the code to add tailroom for encrypted management packets, even if
+crypto_tx_tailroom_needed_cnt is 0.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1912,9 +1912,16 @@ static int ieee80211_skb_resize(struct i
+ int head_need, bool may_encrypt)
+ {
+ struct ieee80211_local *local = sdata->local;
++ struct ieee80211_hdr *hdr;
++ bool enc_tailroom;
+ int tail_need = 0;
+
+- if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
++ hdr = (struct ieee80211_hdr *) skb->data;
++ enc_tailroom = may_encrypt &&
++ (sdata->crypto_tx_tailroom_needed_cnt ||
++ ieee80211_is_mgmt(hdr->frame_control));
++
++ if (enc_tailroom) {
+ tail_need = IEEE80211_ENCRYPT_TAILROOM;
+ tail_need -= skb_tailroom(skb);
+ tail_need = max_t(int, tail_need, 0);
+@@ -1922,8 +1929,7 @@ static int ieee80211_skb_resize(struct i
+
+ if (skb_cloned(skb) &&
+ (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
+- !skb_clone_writable(skb, ETH_HLEN) ||
+- (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
++ !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
+ I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
+ else if (head_need || tail_need)
+ I802_DEBUG_INC(local->tx_expand_skb_head);