[PATCH] ieee80211: Fix TKIP MIC calculation for QoS frames

Fix TKIP MIC verification failure when receiving QoS frames from AP.

Signed-off-by: Hong Liu <hong.liu@intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index 4725ff861c57f74390a66735ee03b50de7492c9e..66dc136588a9df0388adf8fd1a4d18aba46cc26a 100644 (file)
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -104,6 +104,9 @@
 #define IEEE80211_SCTL_FRAG            0x000F
 #define IEEE80211_SCTL_SEQ             0xFFF0
 
+/* QOS control */
+#define IEEE80211_QCTL_TID             0x000F
+
 /* debug macros */
 
 #ifdef CONFIG_IEEE80211_DEBUG

diff --git a/net/ieee80211/ieee80211_crypt_tkip.c b/net/ieee80211/ieee80211_crypt_tkip.c
index 93def94c1b3253e6fca9c960f39be0c5b2404998..3fa5df2e1f0baeceb229fb95a6bd6dd0c2ff081c 100644 (file)
--- a/net/ieee80211/ieee80211_crypt_tkip.c
+++ b/net/ieee80211/ieee80211_crypt_tkip.c
@@ -501,8 +501,11 @@ static int michael_mic(struct ieee80211_tkip_data *tkey, u8 * key, u8 * hdr,
 static void michael_mic_hdr(struct sk_buff *skb, u8 * hdr)
 {
        struct ieee80211_hdr_4addr *hdr11;
+       u16 stype;
 
        hdr11 = (struct ieee80211_hdr_4addr *)skb->data;
+       stype  = WLAN_FC_GET_STYPE(le16_to_cpu(hdr11->frame_ctl));
+
        switch (le16_to_cpu(hdr11->frame_ctl) &
                (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
        case IEEE80211_FCTL_TODS:
@@ -523,7 +526,13 @@ static void michael_mic_hdr(struct sk_buff *skb, u8 * hdr)
                break;
        }
 
-       hdr[12] = 0;            /* priority */
+       if (stype & IEEE80211_STYPE_QOS_DATA) {
+               const struct ieee80211_hdr_3addrqos *qoshdr =
+                       (struct ieee80211_hdr_3addrqos *)skb->data;
+               hdr[12] = le16_to_cpu(qoshdr->qos_ctl) & IEEE80211_QCTL_TID;
+       } else
+               hdr[12] = 0;            /* priority */
+
        hdr[13] = hdr[14] = hdr[15] = 0;        /* reserved */
 }