lkml.org 
[lkml]   [2020]   [Sep]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 149/166] mwifiex: Increase AES key storage size to 256 bits
    Date
    From: Maximilian Luz <luzmaximilian@gmail.com>

    [ Upstream commit 4afc850e2e9e781976fb2c7852ce7bac374af938 ]

    Following commit e18696786548 ("mwifiex: Prevent memory corruption
    handling keys") the mwifiex driver fails to authenticate with certain
    networks, specifically networks with 256 bit keys, and repeatedly asks
    for the password. The kernel log repeats the following lines (id and
    bssid redacted):

    mwifiex_pcie 0000:01:00.0: info: trying to associate to '<id>' bssid <bssid>
    mwifiex_pcie 0000:01:00.0: info: associated to bssid <bssid> successfully
    mwifiex_pcie 0000:01:00.0: crypto keys added
    mwifiex_pcie 0000:01:00.0: info: successfully disconnected from <bssid>: reason code 3

    Tracking down this problem lead to the overflow check introduced by the
    aforementioned commit into mwifiex_ret_802_11_key_material_v2(). This
    check fails on networks with 256 bit keys due to the current storage
    size for AES keys in struct mwifiex_aes_param being only 128 bit.

    To fix this issue, increase the storage size for AES keys to 256 bit.

    Fixes: e18696786548 ("mwifiex: Prevent memory corruption handling keys")
    Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
    Reported-by: Kaloyan Nikolov <konik98@gmail.com>
    Tested-by: Kaloyan Nikolov <konik98@gmail.com>
    Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Brian Norris <briannorris@chromium.org>
    Tested-by: Brian Norris <briannorris@chromium.org>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20200825153829.38043-1-luzmaximilian@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/marvell/mwifiex/fw.h | 2 +-
    drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 4 ++--
    2 files changed, 3 insertions(+), 3 deletions(-)

    diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
    index 342555ebafd79..1d86d29b64ccc 100644
    --- a/drivers/net/wireless/marvell/mwifiex/fw.h
    +++ b/drivers/net/wireless/marvell/mwifiex/fw.h
    @@ -938,7 +938,7 @@ struct mwifiex_tkip_param {
    struct mwifiex_aes_param {
    u8 pn[WPA_PN_SIZE];
    __le16 key_len;
    - u8 key[WLAN_KEY_LEN_CCMP];
    + u8 key[WLAN_KEY_LEN_CCMP_256];
    } __packed;

    struct mwifiex_wapi_param {
    diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
    index 19ce279df24d9..1aeb8cf6dff97 100644
    --- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
    +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
    @@ -624,7 +624,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
    key_v2 = &resp->params.key_material_v2;

    len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
    - if (len > WLAN_KEY_LEN_CCMP)
    + if (len > sizeof(key_v2->key_param_set.key_params.aes.key))
    return -EINVAL;

    if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
    @@ -640,7 +640,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
    return 0;

    memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
    - WLAN_KEY_LEN_CCMP);
    + sizeof(key_v2->key_param_set.key_params.aes.key));
    priv->aes_key_v2.key_param_set.key_params.aes.key_len =
    cpu_to_le16(len);
    memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-09-29 14:36    [W:3.153 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site