]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
mac80211: fix regression where EAPOL frames were sent in plaintext
authorMathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Mon, 19 Oct 2020 16:01:13 +0000 (20:01 +0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 10 Nov 2020 11:39:10 +0000 (12:39 +0100)
commitd44362506d6d5f157d6233bb8d1e89684fcda198
tree80fcc2003f1be48ec784909b6f2dafbda396e60e
parenteafe730e12a933cf06dfb2ccf214cd0857429c09
mac80211: fix regression where EAPOL frames were sent in plaintext

commit 804fc6a2931e692f50e8e317fcb0c8887331b405 upstream.

When sending EAPOL frames via NL80211 they are treated as injected
frames in mac80211. Due to commit 1df2bdba528b ("mac80211: never drop
injected frames even if normally not allowed") these injected frames
were not assigned a sta context in the function ieee80211_tx_dequeue,
causing certain wireless network cards to always send EAPOL frames in
plaintext. This may cause compatibility issues with some clients or
APs, which for instance can cause the group key handshake to fail and
in turn would cause the station to get disconnected.

This commit fixes this regression by assigning a sta context in
ieee80211_tx_dequeue to injected frames as well.

Note that sending EAPOL frames in plaintext is not a security issue
since they contain their own encryption and authentication protection.

Cc: stable@vger.kernel.org
Fixes: 1df2bdba528b ("mac80211: never drop injected frames even if normally not allowed")
Reported-by: Thomas Deutschmann <whissi@gentoo.org>
Tested-by: Christian Hesse <list@eworm.de>
Tested-by: Thomas Deutschmann <whissi@gentoo.org>
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://lore.kernel.org/r/20201019160113.350912-1-Mathy.Vanhoef@kuleuven.be
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/mac80211/tx.c