Message ID | 1457515785-18795-1-git-send-email-emmanuel.grumbach@intel.com (mailing list archive) |
---|---|
State | Changes Requested |
Delegated to: | Johannes Berg |
Headers | show |
On Wed, 2016-03-09 at 11:29 +0200, Emmanuel Grumbach wrote: > From: Sara Sharon <sara.sharon@intel.com> > > Some hardware (iwlwifi an example) de-aggregate AMSDUs and > copy the IV as is to the generated MPDUs, so the same PN > appears in multiple packets without being a replay attack. > Do not increment the PN until all the sub-frames are received > to accommodate to that. > I'll drop this for now since you found an issue with it :) johannes -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c index 7e4f265..7ba66b3 100644 --- a/net/mac80211/wpa.c +++ b/net/mac80211/wpa.c @@ -542,8 +542,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, skb->data + skb->len - mic_len, mic_len)) return RX_DROP_UNUSABLE; } - - memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN); + if (!(status->flag & RX_FLAG_AMSDU_MORE)) + memcpy(key->u.ccmp.rx_pn[queue], pn, + IEEE80211_CCMP_PN_LEN); } /* Remove CCMP header and MIC */ @@ -769,8 +770,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) IEEE80211_GCMP_MIC_LEN)) return RX_DROP_UNUSABLE; } - - memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN); + if (!(status->flag & RX_FLAG_AMSDU_MORE)) + memcpy(key->u.gcmp.rx_pn[queue], pn, + IEEE80211_GCMP_PN_LEN); } /* Remove GCMP header and MIC */