From ab50ff7b12bc6b9ac99a96c4933a0ca4f0f947b4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 16 Aug 2021 15:53:43 +0200 Subject: [PATCH] 4.9-stable patches added patches: mac80211-drop-data-frames-without-key-on-encrypted-links.patch --- ...rames-without-key-on-encrypted-links.patch | 101 ++++++++++++++++++ queue-4.9/series | 1 + 2 files changed, 102 insertions(+) create mode 100644 queue-4.9/mac80211-drop-data-frames-without-key-on-encrypted-links.patch diff --git a/queue-4.9/mac80211-drop-data-frames-without-key-on-encrypted-links.patch b/queue-4.9/mac80211-drop-data-frames-without-key-on-encrypted-links.patch new file mode 100644 index 00000000000..5282070b947 --- /dev/null +++ b/queue-4.9/mac80211-drop-data-frames-without-key-on-encrypted-links.patch @@ -0,0 +1,101 @@ +From a0761a301746ec2d92d7fcb82af69c0a6a4339aa Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 26 Mar 2020 15:09:42 +0200 +Subject: mac80211: drop data frames without key on encrypted links + +From: Johannes Berg + +commit a0761a301746ec2d92d7fcb82af69c0a6a4339aa upstream. + +If we know that we have an encrypted link (based on having had +a key configured for TX in the past) then drop all data frames +in the key selection handler if there's no key anymore. + +This fixes an issue with mac80211 internal TXQs - there we can +buffer frames for an encrypted link, but then if the key is no +longer there when they're dequeued, the frames are sent without +encryption. This happens if a station is disconnected while the +frames are still on the TXQ. + +Detecting that a link should be encrypted based on a first key +having been configured for TX is fine as there are no use cases +for a connection going from with encryption to no encryption. +With extended key IDs, however, there is a case of having a key +configured for only decryption, so we can't just trigger this +behaviour on a key being configured. + +Cc: stable@vger.kernel.org +Reported-by: Jouni Malinen +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20200326150855.6865c7f28a14.I9fb1d911b064262d33e33dfba730cdeef83926ca@changeid +Signed-off-by: Johannes Berg +[pali: Backported to 4.19 and older versions] +Signed-off-by: Pali Rohár +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/debugfs_sta.c | 1 + + net/mac80211/key.c | 1 + + net/mac80211/sta_info.h | 1 + + net/mac80211/tx.c | 12 +++++++++--- + 4 files changed, 12 insertions(+), 3 deletions(-) + +--- a/net/mac80211/debugfs_sta.c ++++ b/net/mac80211/debugfs_sta.c +@@ -80,6 +80,7 @@ static const char * const sta_flag_names + FLAG(MPSP_OWNER), + FLAG(MPSP_RECIPIENT), + FLAG(PS_DELIVER), ++ FLAG(USES_ENCRYPTION), + #undef FLAG + }; + +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -334,6 +334,7 @@ static void ieee80211_key_replace(struct + if (sta) { + if (pairwise) { + rcu_assign_pointer(sta->ptk[idx], new); ++ set_sta_flag(sta, WLAN_STA_USES_ENCRYPTION); + sta->ptk_idx = idx; + ieee80211_check_fast_xmit(sta); + } else { +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -100,6 +100,7 @@ enum ieee80211_sta_info_flags { + WLAN_STA_MPSP_OWNER, + WLAN_STA_MPSP_RECIPIENT, + WLAN_STA_PS_DELIVER, ++ WLAN_STA_USES_ENCRYPTION, + + NUM_WLAN_STA_FLAGS, + }; +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -588,10 +588,13 @@ ieee80211_tx_h_select_key(struct ieee802 + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; + +- if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) ++ if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) { + tx->key = NULL; +- else if (tx->sta && +- (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx]))) ++ return TX_CONTINUE; ++ } ++ ++ if (tx->sta && ++ (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx]))) + tx->key = key; + else if (ieee80211_is_group_privacy_action(tx->skb) && + (key = rcu_dereference(tx->sdata->default_multicast_key))) +@@ -652,6 +655,9 @@ ieee80211_tx_h_select_key(struct ieee802 + if (!skip_hw && tx->key && + tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) + info->control.hw_key = &tx->key->conf; ++ } else if (!ieee80211_is_mgmt(hdr->frame_control) && tx->sta && ++ test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) { ++ return TX_DROP; + } + + return TX_CONTINUE; diff --git a/queue-4.9/series b/queue-4.9/series index 6259c4b9a92..255b3fbbb38 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -14,3 +14,4 @@ pci-msi-correct-misleading-comments.patch pci-msi-use-msi_mask_irq-in-pci_msi_shutdown.patch pci-msi-protect-msi_desc-masked-for-multi-msi.patch vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch +mac80211-drop-data-frames-without-key-on-encrypted-links.patch -- 2.47.3