lkml.org 
[lkml]   [2021]   [Sep]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 010/175] ath: Use safer key clearing with key cache entries
    Date
    From: Jouni Malinen <jouni@codeaurora.org>

    commit 56c5485c9e444c2e85e11694b6c44f1338fc20fd upstream.

    It is possible for there to be pending frames in TXQs with a reference
    to the key cache entry that is being deleted. If such a key cache entry
    is cleared, those pending frame in TXQ might get transmitted without
    proper encryption. It is safer to leave the previously used key into the
    key cache in such cases. Instead, only clear the MAC address to prevent
    RX processing from using this key cache entry.

    This is needed in particularly in AP mode where the TXQs cannot be
    flushed on station disconnection. This change alone may not be able to
    address all cases where the key cache entry might get reused for other
    purposes immediately (the key cache entry should be released for reuse
    only once the TXQs do not have any remaining references to them), but
    this makes it less likely to get unprotected frames and the more
    complete changes may end up being significantly more complex.

    Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20201214172118.18100-2-jouni@codeaurora.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/wireless/ath/key.c | 11 ++++++++++-
    1 file changed, 10 insertions(+), 1 deletion(-)

    --- a/drivers/net/wireless/ath/key.c
    +++ b/drivers/net/wireless/ath/key.c
    @@ -583,7 +583,16 @@ EXPORT_SYMBOL(ath_key_config);
    */
    void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
    {
    - ath_hw_keyreset(common, key->hw_key_idx);
    + /* Leave CCMP and TKIP (main key) configured to avoid disabling
    + * encryption for potentially pending frames already in a TXQ with the
    + * keyix pointing to this key entry. Instead, only clear the MAC address
    + * to prevent RX processing from using this key cache entry.
    + */
    + if (test_bit(key->hw_key_idx, common->ccmp_keymap) ||
    + test_bit(key->hw_key_idx, common->tkip_keymap))
    + ath_hw_keysetmac(common, key->hw_key_idx, NULL);
    + else
    + ath_hw_keyreset(common, key->hw_key_idx);
    if (key->hw_key_idx < IEEE80211_WEP_NKID)
    return;


    \
     
     \ /
      Last update: 2021-09-20 18:56    [W:4.267 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site