From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Johannes Berg" <johannes.berg@intel.com>,
"Jouni Malinen" <j@w1.fi>,
"Luca Coelho" <luciano.coelho@intel.com>,
"Pali Rohár" <pali@kernel.org>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
Subject: [PATCH 4.14 30/64] mac80211: drop data frames without key on encrypted links
Date: Tue, 24 Aug 2021 13:04:23 -0400 [thread overview]
Message-ID: <20210824170457.710623-31-sashal@kernel.org> (raw)
In-Reply-To: <20210824170457.710623-1-sashal@kernel.org>
From: Johannes Berg <johannes.berg@intel.com>
commit a0761a301746ec2d92d7fcb82af69c0a6a4339aa upstream.
If we know that we have an encrypted link (based on having had
a key configured for TX in the past) then drop all data frames
in the key selection handler if there's no key anymore.
This fixes an issue with mac80211 internal TXQs - there we can
buffer frames for an encrypted link, but then if the key is no
longer there when they're dequeued, the frames are sent without
encryption. This happens if a station is disconnected while the
frames are still on the TXQ.
Detecting that a link should be encrypted based on a first key
having been configured for TX is fine as there are no use cases
for a connection going from with encryption to no encryption.
With extended key IDs, however, there is a case of having a key
configured for only decryption, so we can't just trigger this
behaviour on a key being configured.
Cc: stable@vger.kernel.org
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20200326150855.6865c7f28a14.I9fb1d911b064262d33e33dfba730cdeef83926ca@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[pali: Backported to 4.19 and older versions]
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/debugfs_sta.c | 1 +
net/mac80211/key.c | 1 +
net/mac80211/sta_info.h | 1 +
net/mac80211/tx.c | 12 +++++++++---
4 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index b15412c21ac9..d0fed5ceb2b7 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -80,6 +80,7 @@ static const char * const sta_flag_names[] = {
FLAG(MPSP_OWNER),
FLAG(MPSP_RECIPIENT),
FLAG(PS_DELIVER),
+ FLAG(USES_ENCRYPTION),
#undef FLAG
};
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index d122031e389a..87ed1210295f 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -335,6 +335,7 @@ static void ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
if (sta) {
if (pairwise) {
rcu_assign_pointer(sta->ptk[idx], new);
+ set_sta_flag(sta, WLAN_STA_USES_ENCRYPTION);
sta->ptk_idx = idx;
ieee80211_check_fast_xmit(sta);
} else {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index f1d293f5678f..154c26d473a8 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -101,6 +101,7 @@ enum ieee80211_sta_info_flags {
WLAN_STA_MPSP_OWNER,
WLAN_STA_MPSP_RECIPIENT,
WLAN_STA_PS_DELIVER,
+ WLAN_STA_USES_ENCRYPTION,
NUM_WLAN_STA_FLAGS,
};
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 0ab710576673..c7e8935224c0 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -589,10 +589,13 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
- if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
+ if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {
tx->key = NULL;
- else if (tx->sta &&
- (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
+ return TX_CONTINUE;
+ }
+
+ if (tx->sta &&
+ (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
tx->key = key;
else if (ieee80211_is_group_privacy_action(tx->skb) &&
(key = rcu_dereference(tx->sdata->default_multicast_key)))
@@ -653,6 +656,9 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
if (!skip_hw && tx->key &&
tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
info->control.hw_key = &tx->key->conf;
+ } else if (!ieee80211_is_mgmt(hdr->frame_control) && tx->sta &&
+ test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {
+ return TX_DROP;
}
return TX_CONTINUE;
--
2.30.2
next prev parent reply other threads:[~2021-08-24 17:31 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-24 17:03 [PATCH 4.14 00/64] 4.14.245-rc1 review Sasha Levin
2021-08-24 17:03 ` [PATCH 4.14 01/64] iio: humidity: hdc100x: Add margin to the conversion time Sasha Levin
2021-08-24 17:03 ` [PATCH 4.14 02/64] iio: adc: Fix incorrect exit of for-loop Sasha Levin
2021-08-24 17:03 ` [PATCH 4.14 03/64] ASoC: intel: atom: Fix reference to PCM buffer address Sasha Levin
2021-08-24 17:03 ` [PATCH 4.14 04/64] i2c: dev: zero out array used for i2c reads from userspace Sasha Levin
2021-08-24 17:03 ` [PATCH 4.14 05/64] ACPI: NFIT: Fix support for virtual SPA ranges Sasha Levin
2021-08-24 17:03 ` [PATCH 4.14 06/64] ASoC: cs42l42: Correct definition of ADC Volume control Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 07/64] ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 08/64] ASoC: cs42l42: Fix inversion of ADC Notch Switch control Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 09/64] ASoC: cs42l42: Remove duplicate control for WNF filter frequency Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 10/64] net: dsa: mt7530: add the missing RxUnicast MIB counter Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 11/64] ppp: Fix generating ifname when empty IFLA_IFNAME is specified Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 12/64] psample: Add a fwd declaration for skbuff Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 13/64] net: Fix memory leak in ieee802154_raw_deliver Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 14/64] net: bridge: fix memleak in br_add_if() Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 15/64] tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 16/64] xen/events: Fix race in set_evtchn_to_irq Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 17/64] vsock/virtio: avoid potential deadlock when vsock device remove Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 18/64] powerpc/kprobes: Fix kprobe Oops happens in booke Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 19/64] x86/tools: Fix objdump version check again Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 20/64] x86/resctrl: Fix default monitoring groups reporting Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 21/64] PCI/MSI: Enable and mask MSI-X early Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 22/64] PCI/MSI: Do not set invalid bits in MSI mask Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 23/64] PCI/MSI: Correct misleading comments Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 24/64] PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 25/64] PCI/MSI: Protect msi_desc::masked for multi-MSI Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 26/64] PCI/MSI: Mask all unused MSI-X entries Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 27/64] PCI/MSI: Enforce that MSI-X table entry is masked for update Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 28/64] PCI/MSI: Enforce MSI[X] entry updates to be visible Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 29/64] vmlinux.lds.h: Handle clang's module.{c,d}tor sections Sasha Levin
2021-08-24 17:04 ` Sasha Levin [this message]
2021-08-24 17:04 ` [PATCH 4.14 31/64] KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 32/64] KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 33/64] x86/fpu: Make init_fpstate correct with optimized XSAVE Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 34/64] ath: Use safer key clearing with key cache entries Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 35/64] ath9k: Clear key cache explicitly on disabling hardware Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 36/64] ath: Export ath_hw_keysetmac() Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 37/64] ath: Modify ath_key_delete() to not need full key entry Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 38/64] ath9k: Postpone key cache entry deletion for TXQ frames reference it Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 39/64] dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 40/64] ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 41/64] dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 42/64] scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 43/64] scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 44/64] scsi: core: Avoid printing an error if target_alloc() returns -ENXIO Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 45/64] ARM: dts: nomadik: Fix up interrupt controller node names Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 46/64] net: usb: lan78xx: don't modify phy_device state concurrently Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 47/64] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 48/64] dccp: add do-while-0 stubs for dccp_pr_debug macros Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 49/64] vhost: Fix the calculation in vhost_overflow() Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 50/64] bnxt: don't lock the tx queue from napi poll Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 51/64] net: 6pack: fix slab-out-of-bounds in decode_data Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 52/64] ptp_pch: Restore dependency on PCI Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 53/64] net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 54/64] net: mdio-mux: Don't ignore memory allocation errors Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 55/64] net: mdio-mux: Handle -EPROBE_DEFER correctly Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 56/64] mmc: dw_mmc: Fix hang on data CRC error Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 57/64] ALSA: hda - fix the 'Capture Switch' value change notifications Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 58/64] ipack: tpci200: fix many double free issues in tpci200_pci_probe Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 59/64] btrfs: prevent rename2 from exchanging a subvol with a directory from different parents Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 60/64] ASoC: intel: atom: Fix breakage for PCM buffer address setup Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 61/64] locks: print a warning when mount fails due to lack of "mand" support Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 62/64] fs: warn about impending deprecation of mandatory locks Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 63/64] netfilter: nft_exthdr: fix endianness of tcp option cast Sasha Levin
2021-08-24 17:04 ` [PATCH 4.14 64/64] Linux 4.14.245-rc1 Sasha Levin
2021-08-25 20:26 ` [PATCH 4.14 00/64] 4.14.245-rc1 review Guenter Roeck
2021-08-25 21:04 ` Daniel Díaz
2021-08-26 1:01 ` Samuel Zou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210824170457.710623-31-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=j@w1.fi \
--cc=johannes.berg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luciano.coelho@intel.com \
--cc=pali@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).