From nobody Mon Sep 29 21:26:14 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9EB12C32762 for ; Mon, 15 Aug 2022 23:54:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355493AbiHOXwP (ORCPT ); Mon, 15 Aug 2022 19:52:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43996 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355203AbiHOXrP (ORCPT ); Mon, 15 Aug 2022 19:47:15 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5BC6EA8CD6; Mon, 15 Aug 2022 13:15:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3F0ABB81136; Mon, 15 Aug 2022 20:15:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9733EC433D7; Mon, 15 Aug 2022 20:15:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660594523; bh=75Z41sroTYn1e/S0XuKc13w0fL8LkxKB1qEup6hHIg0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y9uBpd3rjGSYPyK1/Yr9M2tR+OXwcAbfuz2MrGlOcLv6g81PiU/ETa7qLr1RfPPSH NVUJlqUeobhbvLJhQ4tzrHXiI84bLW+0uYgOQqQjdbpSyiPDtBi4plQZJRnwHao0dz MoTZY9T3l6ALe9t9Mv/xqmy6QFq0i/65TzxDPZE4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Berg , Sasha Levin Subject: [PATCH 5.19 0473/1157] wifi: mac80211: reject WEP or pairwise keys with key ID > 3 Date: Mon, 15 Aug 2022 19:57:09 +0200 Message-Id: <20220815180458.534586999@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180439.416659447@linuxfoundation.org> References: <20220815180439.416659447@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johannes Berg [ Upstream commit 92ea8df110b8ca92f9664ec7bd76dea109115348 ] We don't really care too much right now since our data structures are set up to not have a problem with this, but clearly it's wrong to accept WEP and pairwise keys with key ID > 3. However, with MLD we need to split into per-link (GTK, IGTK, BIGTK) and per interface/MLD (including WEP) keys so make sure this is not a problem. Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/key.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 0fcf8aebedc4..047a06b857c9 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -433,13 +433,25 @@ static int ieee80211_key_replace(struct ieee80211_sub= _if_data *sdata, int idx; int ret =3D 0; bool defunikey, defmultikey, defmgmtkey, defbeaconkey; + bool is_wep; =20 /* caller must provide at least one old/new */ if (WARN_ON(!new && !old)) return 0; =20 - if (new) + if (new) { + idx =3D new->conf.keyidx; list_add_tail_rcu(&new->list, &sdata->key_list); + is_wep =3D new->conf.cipher =3D=3D WLAN_CIPHER_SUITE_WEP40 || + new->conf.cipher =3D=3D WLAN_CIPHER_SUITE_WEP104; + } else { + idx =3D old->conf.keyidx; + is_wep =3D old->conf.cipher =3D=3D WLAN_CIPHER_SUITE_WEP40 || + old->conf.cipher =3D=3D WLAN_CIPHER_SUITE_WEP104; + } + + if ((is_wep || pairwise) && idx >=3D NUM_DEFAULT_KEYS) + return -EINVAL; =20 WARN_ON(new && old && new->conf.keyidx !=3D old->conf.keyidx); =20 @@ -451,8 +463,6 @@ static int ieee80211_key_replace(struct ieee80211_sub_i= f_data *sdata, } =20 if (old) { - idx =3D old->conf.keyidx; - if (old->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) { ieee80211_key_disable_hw_accel(old); =20 @@ -460,8 +470,6 @@ static int ieee80211_key_replace(struct ieee80211_sub_i= f_data *sdata, ret =3D ieee80211_key_enable_hw_accel(new); } } else { - /* new must be provided in case old is not */ - idx =3D new->conf.keyidx; if (!new->local->wowlan) ret =3D ieee80211_key_enable_hw_accel(new); } --=20 2.35.1