Skip to content

Commit fd4f84f

Browse files
torvaldstorvalds
committed
Merge tag 'staging-4.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH: "Here are three small staging driver fixes for 4.18-rc7. One is a revert of an earlier patch that turned out to be incorrect, one is a fix for the speakup drivers, and the last a fix for the ks7010 driver to resolve a regression. All of these have been in linux-next for a while with no reported issues" * tag 'staging-4.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: speakup: fix wraparound in uaccess length check staging: ks7010: call 'hostif_mib_set_request_int' instead of 'hostif_mib_set_request_bool' Revert "staging:r8188eu: Use lib80211 to support TKIP"
2 parents a5f9e5d + b96fba8 commit fd4f84f

File tree

5 files changed

+171
-101
lines changed

5 files changed

+171
-101
lines changed

‎drivers/staging/ks7010/ks_hostif.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1842,15 +1842,15 @@ void hostif_sme_multicast_set(struct ks_wlan_private *priv)
18421842
memset(set_address, 0, NIC_MAX_MCAST_LIST * ETH_ALEN);
18431843

18441844
if (dev->flags & IFF_PROMISC) {
1845-
hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
1846-
MCAST_FILTER_PROMISC);
1845+
hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
1846+
MCAST_FILTER_PROMISC);
18471847
goto spin_unlock;
18481848
}
18491849

18501850
if ((netdev_mc_count(dev) > NIC_MAX_MCAST_LIST) ||
18511851
(dev->flags & IFF_ALLMULTI)) {
1852-
hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
1853-
MCAST_FILTER_MCASTALL);
1852+
hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
1853+
MCAST_FILTER_MCASTALL);
18541854
goto spin_unlock;
18551855
}
18561856

@@ -1866,8 +1866,8 @@ void hostif_sme_multicast_set(struct ks_wlan_private *priv)
18661866
ETH_ALEN * mc_count);
18671867
} else {
18681868
priv->sme_i.sme_flag |= SME_MULTICAST;
1869-
hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
1870-
MCAST_FILTER_MCAST);
1869+
hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
1870+
MCAST_FILTER_MCAST);
18711871
}
18721872

18731873
spin_unlock:

‎drivers/staging/rtl8188eu/Kconfig

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ config R8188EU
77
select LIB80211
88
select LIB80211_CRYPT_WEP
99
select LIB80211_CRYPT_CCMP
10-
select LIB80211_CRYPT_TKIP
1110
---help---
1211
This option adds the Realtek RTL8188EU USB device such as TP-Link TL-WN725N.
1312
If built as a module, it will be called r8188eu.

‎drivers/staging/rtl8188eu/core/rtw_recv.c

Lines changed: 114 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
#include <mon.h>
2424
#include <wifi.h>
2525
#include <linux/vmalloc.h>
26-
#include <net/lib80211.h>
2726

2827
#define ETHERNET_HEADER_SIZE 14 /* Ethernet Header Length */
2928
#define LLC_HEADER_SIZE 6 /* LLC Header Length */
@@ -221,20 +220,31 @@ u32 rtw_free_uc_swdec_pending_queue(struct adapter *adapter)
221220
static int recvframe_chkmic(struct adapter *adapter,
222221
struct recv_frame *precvframe)
223222
{
224-
int res = _SUCCESS;
225-
struct rx_pkt_attrib *prxattrib = &precvframe->attrib;
226-
struct sta_info *stainfo = rtw_get_stainfo(&adapter->stapriv, prxattrib->ta);
223+
int i, res = _SUCCESS;
224+
u32 datalen;
225+
u8 miccode[8];
226+
u8 bmic_err = false, brpt_micerror = true;
227+
u8 *pframe, *payload, *pframemic;
228+
u8 *mickey;
229+
struct sta_info *stainfo;
230+
struct rx_pkt_attrib *prxattrib = &precvframe->attrib;
231+
struct security_priv *psecuritypriv = &adapter->securitypriv;
232+
233+
struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
234+
struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
235+
236+
stainfo = rtw_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]);
227237

228238
if (prxattrib->encrypt == _TKIP_) {
239+
RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
240+
("\n %s: prxattrib->encrypt==_TKIP_\n", __func__));
241+
RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
242+
("\n %s: da=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
243+
__func__, prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
244+
prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5]));
245+
246+
/* calculate mic code */
229247
if (stainfo) {
230-
int key_idx;
231-
const int iv_len = 8, icv_len = 4, key_length = 32;
232-
struct sk_buff *skb = precvframe->pkt;
233-
u8 key[32], iv[8], icv[4], *pframe = skb->data;
234-
void *crypto_private = NULL;
235-
struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
236-
struct security_priv *psecuritypriv = &adapter->securitypriv;
237-
238248
if (IS_MCAST(prxattrib->ra)) {
239249
if (!psecuritypriv) {
240250
res = _FAIL;
@@ -243,58 +253,115 @@ static int recvframe_chkmic(struct adapter *adapter,
243253
DBG_88E("\n %s: didn't install group key!!!!!!!!!!\n", __func__);
244254
goto exit;
245255
}
246-
key_idx = prxattrib->key_index;
247-
memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
248-
memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
256+
mickey = &psecuritypriv->dot118021XGrprxmickey[prxattrib->key_index].skey[0];
257+
258+
RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
259+
("\n %s: bcmc key\n", __func__));
249260
} else {
250-
key_idx = 0;
251-
memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
252-
memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
261+
mickey = &stainfo->dot11tkiprxmickey.skey[0];
262+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
263+
("\n %s: unicast key\n", __func__));
253264
}
254265

255-
if (!crypto_ops) {
256-
res = _FAIL;
257-
goto exit_lib80211_tkip;
258-
}
266+
/* icv_len included the mic code */
267+
datalen = precvframe->pkt->len-prxattrib->hdrlen -
268+
prxattrib->iv_len-prxattrib->icv_len-8;
269+
pframe = precvframe->pkt->data;
270+
payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
259271

260-
memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
261-
memcpy(icv, pframe + skb->len - icv_len, icv_len);
262-
memmove(pframe + iv_len, pframe, prxattrib->hdrlen);
272+
RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len));
273+
rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0],
274+
(unsigned char)prxattrib->priority); /* care the length of the data */
263275

264-
skb_pull(skb, iv_len);
265-
skb_trim(skb, skb->len - icv_len);
276+
pframemic = payload+datalen;
266277

267-
crypto_private = crypto_ops->init(key_idx);
268-
if (!crypto_private) {
269-
res = _FAIL;
270-
goto exit_lib80211_tkip;
271-
}
272-
if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
273-
res = _FAIL;
274-
goto exit_lib80211_tkip;
275-
}
276-
if (crypto_ops->decrypt_msdu(skb, key_idx, prxattrib->hdrlen, crypto_private)) {
277-
res = _FAIL;
278-
goto exit_lib80211_tkip;
278+
bmic_err = false;
279+
280+
for (i = 0; i < 8; i++) {
281+
if (miccode[i] != *(pframemic+i)) {
282+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
283+
("%s: miccode[%d](%02x)!=*(pframemic+%d)(%02x) ",
284+
__func__, i, miccode[i], i, *(pframemic + i)));
285+
bmic_err = true;
286+
}
279287
}
280288

281-
memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
282-
skb_push(skb, iv_len);
283-
skb_put(skb, icv_len);
289+
if (bmic_err) {
290+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
291+
("\n *(pframemic-8)-*(pframemic-1)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
292+
*(pframemic-8), *(pframemic-7), *(pframemic-6),
293+
*(pframemic-5), *(pframemic-4), *(pframemic-3),
294+
*(pframemic-2), *(pframemic-1)));
295+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
296+
("\n *(pframemic-16)-*(pframemic-9)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
297+
*(pframemic-16), *(pframemic-15), *(pframemic-14),
298+
*(pframemic-13), *(pframemic-12), *(pframemic-11),
299+
*(pframemic-10), *(pframemic-9)));
300+
{
301+
uint i;
284302

285-
memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
286-
memcpy(pframe + skb->len - icv_len, icv, icv_len);
303+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
304+
("\n ======demp packet (len=%d)======\n",
305+
precvframe->pkt->len));
306+
for (i = 0; i < precvframe->pkt->len; i += 8) {
307+
RT_TRACE(_module_rtl871x_recv_c_,
308+
_drv_err_,
309+
("0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x",
310+
*(precvframe->pkt->data+i),
311+
*(precvframe->pkt->data+i+1),
312+
*(precvframe->pkt->data+i+2),
313+
*(precvframe->pkt->data+i+3),
314+
*(precvframe->pkt->data+i+4),
315+
*(precvframe->pkt->data+i+5),
316+
*(precvframe->pkt->data+i+6),
317+
*(precvframe->pkt->data+i+7)));
318+
}
319+
RT_TRACE(_module_rtl871x_recv_c_,
320+
_drv_err_,
321+
("\n ====== demp packet end [len=%d]======\n",
322+
precvframe->pkt->len));
323+
RT_TRACE(_module_rtl871x_recv_c_,
324+
_drv_err_,
325+
("\n hrdlen=%d,\n",
326+
prxattrib->hdrlen));
327+
}
287328

288-
exit_lib80211_tkip:
289-
if (crypto_ops && crypto_private)
290-
crypto_ops->deinit(crypto_private);
329+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
330+
("ra=0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x psecuritypriv->binstallGrpkey=%d ",
331+
prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
332+
prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5], psecuritypriv->binstallGrpkey));
333+
334+
/* double check key_index for some timing issue , */
335+
/* cannot compare with psecuritypriv->dot118021XGrpKeyid also cause timing issue */
336+
if ((IS_MCAST(prxattrib->ra) == true) && (prxattrib->key_index != pmlmeinfo->key_index))
337+
brpt_micerror = false;
338+
339+
if ((prxattrib->bdecrypted) && (brpt_micerror)) {
340+
rtw_handle_tkip_mic_err(adapter, (u8)IS_MCAST(prxattrib->ra));
341+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
342+
DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
343+
} else {
344+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
345+
DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
346+
}
347+
res = _FAIL;
348+
} else {
349+
/* mic checked ok */
350+
if ((!psecuritypriv->bcheck_grpkey) && (IS_MCAST(prxattrib->ra))) {
351+
psecuritypriv->bcheck_grpkey = true;
352+
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("psecuritypriv->bcheck_grpkey = true"));
353+
}
354+
}
291355
} else {
292356
RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
293357
("%s: rtw_get_stainfo==NULL!!!\n", __func__));
294358
}
359+
360+
skb_trim(precvframe->pkt, precvframe->pkt->len - 8);
295361
}
296362

297363
exit:
364+
298365
return res;
299366
}
300367

‎drivers/staging/rtl8188eu/core/rtw_security.c

Lines changed: 46 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -650,71 +650,71 @@ u32 rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe)
650650
return res;
651651
}
652652

653+
/* The hlen isn't include the IV */
653654
u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
654-
{
655-
struct rx_pkt_attrib *prxattrib = &((struct recv_frame *)precvframe)->attrib;
656-
u32 res = _SUCCESS;
655+
{ /* exclude ICV */
656+
u16 pnl;
657+
u32 pnh;
658+
u8 rc4key[16];
659+
u8 ttkey[16];
660+
u8 crc[4];
661+
struct arc4context mycontext;
662+
int length;
663+
664+
u8 *pframe, *payload, *iv, *prwskey;
665+
union pn48 dot11txpn;
666+
struct sta_info *stainfo;
667+
struct rx_pkt_attrib *prxattrib = &((struct recv_frame *)precvframe)->attrib;
668+
struct security_priv *psecuritypriv = &padapter->securitypriv;
669+
u32 res = _SUCCESS;
670+
671+
672+
pframe = (unsigned char *)((struct recv_frame *)precvframe)->pkt->data;
657673

658674
/* 4 start to decrypt recvframe */
659675
if (prxattrib->encrypt == _TKIP_) {
660-
struct sta_info *stainfo = rtw_get_stainfo(&padapter->stapriv, prxattrib->ta);
661-
676+
stainfo = rtw_get_stainfo(&padapter->stapriv, &prxattrib->ta[0]);
662677
if (stainfo) {
663-
int key_idx;
664-
const int iv_len = 8, icv_len = 4, key_length = 32;
665-
void *crypto_private = NULL;
666-
struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt;
667-
u8 key[32], iv[8], icv[4], *pframe = skb->data;
668-
struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
669-
struct security_priv *psecuritypriv = &padapter->securitypriv;
670-
671678
if (IS_MCAST(prxattrib->ra)) {
672679
if (!psecuritypriv->binstallGrpkey) {
673680
res = _FAIL;
674681
DBG_88E("%s:rx bc/mc packets, but didn't install group key!!!!!!!!!!\n", __func__);
675682
goto exit;
676683
}
677-
key_idx = prxattrib->key_index;
678-
memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
679-
memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
684+
prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey;
680685
} else {
681-
key_idx = 0;
682-
memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
683-
memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
686+
RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("%s: stainfo!= NULL!!!\n", __func__));
687+
prwskey = &stainfo->dot118021x_UncstKey.skey[0];
684688
}
685689

686-
if (!crypto_ops) {
687-
res = _FAIL;
688-
goto exit_lib80211_tkip;
689-
}
690+
iv = pframe+prxattrib->hdrlen;
691+
payload = pframe+prxattrib->iv_len+prxattrib->hdrlen;
692+
length = ((struct recv_frame *)precvframe)->pkt->len-prxattrib->hdrlen-prxattrib->iv_len;
690693

691-
memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
692-
memcpy(icv, pframe + skb->len - icv_len, icv_len);
694+
GET_TKIP_PN(iv, dot11txpn);
693695

694-
crypto_private = crypto_ops->init(key_idx);
695-
if (!crypto_private) {
696-
res = _FAIL;
697-
goto exit_lib80211_tkip;
698-
}
699-
if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
700-
res = _FAIL;
701-
goto exit_lib80211_tkip;
702-
}
703-
if (crypto_ops->decrypt_mpdu(skb, prxattrib->hdrlen, crypto_private)) {
704-
res = _FAIL;
705-
goto exit_lib80211_tkip;
706-
}
696+
pnl = (u16)(dot11txpn.val);
697+
pnh = (u32)(dot11txpn.val>>16);
707698

708-
memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
709-
skb_push(skb, iv_len);
710-
skb_put(skb, icv_len);
699+
phase1((u16 *)&ttkey[0], prwskey, &prxattrib->ta[0], pnh);
700+
phase2(&rc4key[0], prwskey, (unsigned short *)&ttkey[0], pnl);
711701

712-
memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
713-
memcpy(pframe + skb->len - icv_len, icv, icv_len);
702+
/* 4 decrypt payload include icv */
714703

715-
exit_lib80211_tkip:
716-
if (crypto_ops && crypto_private)
717-
crypto_ops->deinit(crypto_private);
704+
arcfour_init(&mycontext, rc4key, 16);
705+
arcfour_encrypt(&mycontext, payload, payload, length);
706+
707+
*((__le32 *)crc) = getcrc32(payload, length-4);
708+
709+
if (crc[3] != payload[length-1] ||
710+
crc[2] != payload[length-2] ||
711+
crc[1] != payload[length-3] ||
712+
crc[0] != payload[length-4]) {
713+
RT_TRACE(_module_rtl871x_security_c_, _drv_err_,
714+
("rtw_wep_decrypt:icv error crc (%4ph)!=payload (%4ph)\n",
715+
&crc, &payload[length-4]));
716+
res = _FAIL;
717+
}
718718
} else {
719719
RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("rtw_tkip_decrypt: stainfo==NULL!!!\n"));
720720
res = _FAIL;

‎drivers/staging/speakup/speakup_soft.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,11 +198,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
198198
int chars_sent = 0;
199199
char __user *cp;
200200
char *init;
201+
size_t bytes_per_ch = unicode ? 3 : 1;
201202
u16 ch;
202203
int empty;
203204
unsigned long flags;
204205
DEFINE_WAIT(wait);
205206

207+
if (count < bytes_per_ch)
208+
return -EINVAL;
209+
206210
spin_lock_irqsave(&speakup_info.spinlock, flags);
207211
while (1) {
208212
prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE);
@@ -228,7 +232,7 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
228232
init = get_initstring();
229233

230234
/* Keep 3 bytes available for a 16bit UTF-8-encoded character */
231-
while (chars_sent <= count - 3) {
235+
while (chars_sent <= count - bytes_per_ch) {
232236
if (speakup_info.flushing) {
233237
speakup_info.flushing = 0;
234238
ch = '\x18';

0 commit comments

Comments
 (0)