• Johannes Berg's avatar
    cfg80211: wext: really don't store non-WEP keys · 8f7d99ba
    Johannes Berg authored
    Jouni reported that during (repeated) wext_pmf test runs (from the
    wpa_supplicant hwsim test suite) the kernel crashes. The reason is
    that after the key is set, the wext code still unnecessarily stores
    it into the key cache. Despite smatch pointing out an overflow, I
    failed to identify the possibility for this in the code and missed
    it during development of the earlier patch series.
    
    In order to fix this, simply check that we never store anything but
    WEP keys into the cache, adding a comment as to why that's enough.
    
    Also, since the cache is still allocated early even if it won't be
    used in many cases, add a comment explaining why - otherwise we'd
    have to roll back key settings to the driver in case of allocation
    failures, which is far more difficult.
    
    Fixes: 89b706fb ("cfg80211: reduce connect key caching struct size")
    Reported-by: default avatarJouni Malinen <j@w1.fi>
    Bisected-by: default avatarJouni Malinen <j@w1.fi>
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    8f7d99ba
wext-compat.c 38.6 KB