From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22F04C388F7 for ; Mon, 9 Nov 2020 13:21:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C14EF2076E for ; Mon, 9 Nov 2020 13:21:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604928103; bh=0UJ8wjG8e3mJkJAcQS878fIT03u4N7tu2eZskINx980=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=SMXjPNhXWIXzXYbmZVf6gTIqESJEqCp+qIqTlvhF62O2m5qIqWyP74ClojGVEw1we rFZyzAxSrI+QJFuwGxCdI7Bdm6jsyvgjpEv6WpRhOcHkpTTDjn8hCZ7q/JLoE5qQed 7eghY+ksQ4LXN2l9OSWPkD8iqLHeqj/GozPbSXtM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387800AbgKINVm (ORCPT ); Mon, 9 Nov 2020 08:21:42 -0500 Received: from mail.kernel.org ([198.145.29.99]:49494 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388088AbgKINVj (ORCPT ); Mon, 9 Nov 2020 08:21:39 -0500 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AA7F22065D; Mon, 9 Nov 2020 13:21:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604928098; bh=0UJ8wjG8e3mJkJAcQS878fIT03u4N7tu2eZskINx980=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SiB0qGi2cj1EsJX6c4xXjBhAEArDPfLsC1RJCs57rSAadxq8Ugh3+83I1ooUiNUjP GDVLrRcembRGukOhDv4FIF0Vc9mjD0WhKjFeO+ocSQ5RUCj9q2G8N9GgB0IDMvHZnK fjGFHK8PACLDpaqI9HO+k9FAxVzO3HWPh0J9M3cM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Deutschmann , Christian Hesse , Mathy Vanhoef , Johannes Berg Subject: [PATCH 5.9 125/133] mac80211: fix regression where EAPOL frames were sent in plaintext Date: Mon, 9 Nov 2020 13:56:27 +0100 Message-Id: <20201109125036.699937228@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201109125030.706496283@linuxfoundation.org> References: <20201109125030.706496283@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mathy Vanhoef commit 804fc6a2931e692f50e8e317fcb0c8887331b405 upstream. When sending EAPOL frames via NL80211 they are treated as injected frames in mac80211. Due to commit 1df2bdba528b ("mac80211: never drop injected frames even if normally not allowed") these injected frames were not assigned a sta context in the function ieee80211_tx_dequeue, causing certain wireless network cards to always send EAPOL frames in plaintext. This may cause compatibility issues with some clients or APs, which for instance can cause the group key handshake to fail and in turn would cause the station to get disconnected. This commit fixes this regression by assigning a sta context in ieee80211_tx_dequeue to injected frames as well. Note that sending EAPOL frames in plaintext is not a security issue since they contain their own encryption and authentication protection. Cc: stable@vger.kernel.org Fixes: 1df2bdba528b ("mac80211: never drop injected frames even if normally not allowed") Reported-by: Thomas Deutschmann Tested-by: Christian Hesse Tested-by: Thomas Deutschmann Signed-off-by: Mathy Vanhoef Link: https://lore.kernel.org/r/20201019160113.350912-1-Mathy.Vanhoef@kuleuven.be Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/tx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -3613,13 +3613,14 @@ begin: tx.skb = skb; tx.sdata = vif_to_sdata(info->control.vif); - if (txq->sta && !(info->flags & IEEE80211_TX_CTL_INJECTED)) { + if (txq->sta) { tx.sta = container_of(txq->sta, struct sta_info, sta); /* * Drop unicast frames to unauthorised stations unless they are - * EAPOL frames from the local station. + * injected frames or EAPOL frames from the local station. */ - if (unlikely(ieee80211_is_data(hdr->frame_control) && + if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) && + ieee80211_is_data(hdr->frame_control) && !ieee80211_vif_is_mesh(&tx.sdata->vif) && tx.sdata->vif.type != NL80211_IFTYPE_OCB && !is_multicast_ether_addr(hdr->addr1) &&