wifi: mac80211: allow cipher change on NAN_DATA interfaces

ieee80211_key_link() rejects pairwise key installation when the
cipher differs from the existing PTK. Per Wi-Fi Aware version 4.0
section 7.4, the ND-TKSA between the same NDI pair shall be updated
when a new NDP requires a stronger cipher suite.

Exempt NL80211_IFTYPE_NAN_DATA from the same-cipher enforcement so
the PTK can be replaced with a different cipher.

Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260515142736.3188a47a23bf.I5fba3a111ffe054b46928aefa5c2d763fef51d4d@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 3030bd40bca007c6fac2953333c3a3c5d78e488c..f45e792abede57eeaf5e14cb02387aac4fbd7d9e 100644 (file)
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -870,11 +870,16 @@ int ieee80211_key_link(struct ieee80211_key *key,
                alt_key = wiphy_dereference(sdata->local->hw.wiphy,
                                            sta->ptk[idx ^ 1]);
 
-               /* The rekey code assumes that the old and new key are using
+               /*
+                * The rekey code assumes that the old and new key are using
                 * the same cipher. Enforce the assumption for pairwise keys.
+                * NAN Data interfaces are exempt: Wi-Fi Aware v4.0 section 7.4
+                * requires upgrading the ND-TKSA when a new NDP negotiates a
+                * stronger cipher suite.
                 */
-               if ((alt_key && alt_key->conf.cipher != key->conf.cipher) ||
-                   (old_key && old_key->conf.cipher != key->conf.cipher)) {
+               if (sdata->vif.type != NL80211_IFTYPE_NAN_DATA &&
+                   ((alt_key && alt_key->conf.cipher != key->conf.cipher) ||
+                    (old_key && old_key->conf.cipher != key->conf.cipher))) {
                        ret = -EOPNOTSUPP;
                        goto out;
                }