linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Emmanuel Grumbach <emmanuel.grumbach@intel.com>,
	Luca Coelho <luciano.coelho@intel.com>,
	Johannes Berg <johannes.berg@intel.com>,
	Sasha Levin <alexander.levin@microsoft.com>
Subject: [PATCH 3.18 26/47] mac80211: dont parse encrypted management frames in ieee80211_frame_acked
Date: Fri, 23 Mar 2018 10:55:17 +0100	[thread overview]
Message-ID: <20180323094249.235716745@linuxfoundation.org> (raw)
In-Reply-To: <20180323094248.117679641@linuxfoundation.org>

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>


[ Upstream commit cf147085fdda044622973a12e4e06f1c753ab677 ]

ieee80211_frame_acked is called when a frame is acked by
the peer. In case this is a management frame, we check
if this an SMPS frame, in which case we can update our
antenna configuration.

When we parse the management frame we look at the category
in case it is an action frame. That byte sits after the IV
in case the frame was encrypted. This means that if the
frame was encrypted, we basically look at the IV instead
of looking at the category. It is then theorically
possible that we think that an SMPS action frame was acked
where really we had another frame that was encrypted.

Since the only management frame whose ack needs to be
tracked is the SMPS action frame, and that frame is not
a robust management frame, it will never be encrypted.
The easiest way to fix this problem is then to not look
at frames that were encrypted.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/status.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -194,6 +194,7 @@ static void ieee80211_frame_acked(struct
 	}
 
 	if (ieee80211_is_action(mgmt->frame_control) &&
+	    !ieee80211_has_protected(mgmt->frame_control) &&
 	    mgmt->u.action.category == WLAN_CATEGORY_HT &&
 	    mgmt->u.action.u.ht_smps.action == WLAN_HT_ACTION_SMPS &&
 	    ieee80211_sdata_running(sdata)) {

  parent reply	other threads:[~2018-03-23  9:55 UTC|newest]

Thread overview: 54+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-23  9:54 [PATCH 3.18 00/47] 3.18.102-stable review Greg Kroah-Hartman
2018-03-23  9:54 ` [PATCH 3.18 01/47] platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA Greg Kroah-Hartman
2018-03-23  9:54 ` [PATCH 3.18 02/47] x86: i8259: export legacy_pic symbol Greg Kroah-Hartman
2018-03-23  9:54 ` [PATCH 3.18 03/47] Input: ar1021_i2c - fix too long name in drivers device table Greg Kroah-Hartman
2018-03-23  9:54 ` [PATCH 3.18 04/47] ACPI/processor: Replace racy task affinity logic Greg Kroah-Hartman
2018-03-23  9:54 ` [PATCH 3.18 05/47] cpufreq/sh: " Greg Kroah-Hartman
2018-03-23  9:54 ` [PATCH 3.18 06/47] genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs Greg Kroah-Hartman
2018-03-23  9:54 ` [PATCH 3.18 07/47] i2c: i2c-scmi: add a MS HID Greg Kroah-Hartman
2018-03-23  9:54 ` [PATCH 3.18 08/47] net: ipv6: send unsolicited NA on admin up Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 09/47] [media] media/dvb-core: Race condition when writing to CAM Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 10/47] spi: dw: Disable clock after unregistering the host Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 11/47] ath: Fix updating radar flags for coutry code India Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 12/47] scsi: virtio_scsi: Always try to read VPD pages Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 13/47] KVM: PPC: Book3S PR: Exit KVM on failed mapping Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 14/47] tcp: remove poll() flakes with FastOpen Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 15/47] e1000e: fix timing for 82579 Gigabit Ethernet controller Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 16/47] ALSA: hda - Fix headset microphone detection for ASUS N551 and N751 Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 17/47] IB/ipoib: Update broadcast object if PKey value was changed in index 0 Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 18/47] HSI: ssi_protocol: double free in ssip_pn_xmit() Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 19/47] Fix driver usage of 128B WQEs when WQ_CREATE is V1 Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 20/47] mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 21/47] wan: pc300too: abort path on failure Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 22/47] qlcnic: fix unchecked return value Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 23/47] scsi: mac_esp: Replace bogus memory barrier with spinlock Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 24/47] rndis_wlan: add return value validation Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 25/47] Btrfs: send, fix file hole not being preserved due to inline extent Greg Kroah-Hartman
2018-03-23  9:55 ` Greg Kroah-Hartman [this message]
2018-03-23  9:55 ` [PATCH 3.18 27/47] mfd: palmas: Reset the POWERHOLD mux during power off Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 28/47] ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 29/47] ipmi/watchdog: fix wdog hang on panic waiting for ipmi response Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 30/47] bnx2x: Align RX buffers Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 31/47] power: supply: pda_power: move from timer to delayed_work Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 32/47] md/raid10: skip spare disk as first disk Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 33/47] ia64: fix module loading for gcc-5.4 Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 34/47] video: fbdev: udlfb: Fix buffer on stack Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 35/47] sm501fb: dont return zero on failure path in sm501fb_start() Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 36/47] cifs: small underflow in cnvrtDosUnixTm() Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 37/47] drm/msm: fix leak in failed get_pages Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 38/47] media: bt8xx: Fix err bt878_probe() Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 39/47] media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 40/47] mmc: avoid removing non-removable hosts during suspend Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 41/47] IB/ipoib: Avoid memory leak if the SA returns a different DGID Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 42/47] RDMA/cma: Use correct size when writing netlink stats Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 43/47] vgacon: Set VGA struct resource types Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 44/47] drm/omap: DMM: Check for DMM readiness after successful transaction commit Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 45/47] pinctrl: Really force states during suspend/resume Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 46/47] clk: si5351: Rename internal plls to avoid name collisions Greg Kroah-Hartman
2018-03-23  9:55 ` [PATCH 3.18 47/47] RDMA/ucma: Fix access to non-initialized CM_ID object Greg Kroah-Hartman
2018-03-23 14:00 ` [PATCH 3.18 00/47] 3.18.102-stable review kernelci.org bot
2018-03-23 20:43 ` Shuah Khan
2018-03-24  7:46   ` Greg Kroah-Hartman
2018-03-24  0:07 ` Guenter Roeck
2018-03-24  9:40 ` Harsh Shandilya
2018-03-24 10:05   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180323094249.235716745@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=alexander.levin@microsoft.com \
    --cc=emmanuel.grumbach@intel.com \
    --cc=johannes.berg@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luciano.coelho@intel.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).