From: Sara Sharon <sara.sharon@xxxxxxxxx> Some hardware (iwlwifi an example) de-aggregate AMSDUs and copy the IV as is to the generated MPDUs, so the same PN appears in multiple packets without being a replay attack. Do not increment the PN until all the sub-frames are received to accommodate to that. Signed-off-by: Sara Sharon <sara.sharon@xxxxxxxxx> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> --- net/mac80211/wpa.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c index 7e4f265..7ba66b3 100644 --- a/net/mac80211/wpa.c +++ b/net/mac80211/wpa.c @@ -542,8 +542,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, skb->data + skb->len - mic_len, mic_len)) return RX_DROP_UNUSABLE; } - - memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN); + if (!(status->flag & RX_FLAG_AMSDU_MORE)) + memcpy(key->u.ccmp.rx_pn[queue], pn, + IEEE80211_CCMP_PN_LEN); } /* Remove CCMP header and MIC */ @@ -769,8 +770,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) IEEE80211_GCMP_MIC_LEN)) return RX_DROP_UNUSABLE; } - - memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN); + if (!(status->flag & RX_FLAG_AMSDU_MORE)) + memcpy(key->u.gcmp.rx_pn[queue], pn, + IEEE80211_GCMP_PN_LEN); } /* Remove GCMP header and MIC */ -- 2.5.0 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
