{"push_id":1621730794,"size":1,"distinct_size":1,"ref":"refs/heads/cm-12.1","head":"1168fa93a537646f5920137b39092d5cc8368000","before":"88733466ebf44b8412cfcdb79ca9e1f43a62560d","commits":[{"sha":"1168fa93a537646f5920137b39092d5cc8368000","author":{"name":"DerfElot","email":"352662509ca90e551a7c1b98c3f7a8d801b758f4@gmail.com"},"message":"mac80211: fix fragmentation code, particularly for encryption\nThe \"new\" fragmentation code (since my rewrite almost 5 years ago)\nerroneously sets skb->len rather than using skb_trim() to adjust\nthe length of the first fragment after copying out all the others.\nThis leaves the skb tail pointer pointing to after where the data\noriginally ended, and thus causes the encryption MIC to be written\nat that point, rather than where it belongs: immediately after the\ndata.\n\nThe impact of this is that if software encryption is done, then\n a) encryption doesn't work for the first fragment, the connection\n    becomes unusable as the first fragment will never be properly\n    verified at the receiver, the MIC is practically guaranteed to\n    be wrong\n b) we leak up to 8 bytes of plaintext (!) of the packet out into\n    the air\n\nThis is only mitigated by the fact that many devices are capable\nof doing encryption in hardware, in which case this can't happen\nas the tail pointer is irrelevant in that case. Additionally,\nfragmentation is not used very frequently and would normally have\nto be configured manually.\n\nFix this by using skb_trim() properly.\n\nCc: stable@vger.kernel.org\nFixes: 2de8e0d999b8 (\"mac80211: rewrite fragmentation\")\nReported-by: Jouni Malinen <j@w1.fi>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/derfelot/android_kernel_sony_msm8974/commits/1168fa93a537646f5920137b39092d5cc8368000"}]}
{"actor":{"display_login":"derfelot"}}