diff options
| author | Felix Fietkau <nbd@nbd.name> | 2019-01-29 13:10:57 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-05-02 23:41:33 +0300 |
| commit | b6706ab0540c4fbb5424cbaf7c0ce7c87f7a0ba7 (patch) | |
| tree | d636a9128207bd3c9754192ed26f4d8f3c3b9322 | |
| parent | 4e938011d7529cc89a79e6077b8767b6c5ef0f48 (diff) | |
| download | linux-b6706ab0540c4fbb5424cbaf7c0ce7c87f7a0ba7.tar.xz | |
mac80211: ensure that mgmt tx skbs have tailroom for encryption
commit 9d0f50b80222dc273e67e4e14410fcfa4130a90c upstream.
Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management
frames need to be software encrypted. Since normal data packets are still
encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented
after key upload to hw. This can lead to passing skbs to ccmp_encrypt_skb,
which don't have the necessary tailroom for software encryption.
Change the code to add tailroom for encrypted management packets, even if
crypto_tx_tailroom_needed_cnt is 0.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.16: we always expand cloned skbs here; don't change that]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | net/mac80211/tx.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index d698d23dceed..7b057e323230 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1465,9 +1465,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, int head_need, bool may_encrypt) { struct ieee80211_local *local = sdata->local; + struct ieee80211_hdr *hdr; + bool enc_tailroom; int tail_need = 0; - if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) { + hdr = (struct ieee80211_hdr *) skb->data; + enc_tailroom = may_encrypt && + (sdata->crypto_tx_tailroom_needed_cnt || + ieee80211_is_mgmt(hdr->frame_control)); + + if (enc_tailroom) { tail_need = IEEE80211_ENCRYPT_TAILROOM; tail_need -= skb_tailroom(skb); tail_need = max_t(int, tail_need, 0); |