| Message ID | 20200925171941.2997305-2-jesse.sung@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | mwifiex stops working after kernel upgrade | expand |
On 25.09.20 19:19, Wen-chien Jesse Sung wrote: > From: Maximilian Luz <luzmaximilian@gmail.com> > > BugLink: https://launchpad.net/bugs/1897299 > > Following commit e18696786548 ("mwifiex: Prevent memory corruption > handling keys") the mwifiex driver fails to authenticate with certain > networks, specifically networks with 256 bit keys, and repeatedly asks > for the password. The kernel log repeats the following lines (id and > bssid redacted): > > mwifiex_pcie 0000:01:00.0: info: trying to associate to '<id>' bssid <bssid> > mwifiex_pcie 0000:01:00.0: info: associated to bssid <bssid> successfully > mwifiex_pcie 0000:01:00.0: crypto keys added > mwifiex_pcie 0000:01:00.0: info: successfully disconnected from <bssid>: reason code 3 > > Tracking down this problem lead to the overflow check introduced by the > aforementioned commit into mwifiex_ret_802_11_key_material_v2(). This > check fails on networks with 256 bit keys due to the current storage > size for AES keys in struct mwifiex_aes_param being only 128 bit. > > To fix this issue, increase the storage size for AES keys to 256 bit. > > Fixes: e18696786548 ("mwifiex: Prevent memory corruption handling keys") > Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com> > Reported-by: Kaloyan Nikolov <konik98@gmail.com> > Tested-by: Kaloyan Nikolov <konik98@gmail.com> > Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> > Reviewed-by: Brian Norris <briannorris@chromium.org> > Tested-by: Brian Norris <briannorris@chromium.org> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> > Link: https://lore.kernel.org/r/20200825153829.38043-1-luzmaximilian@gmail.com > (backported from commit 4afc850e2e9e781976fb2c7852ce7bac374af938) > Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- > drivers/net/wireless/mwifiex/fw.h | 2 +- > drivers/net/wireless/mwifiex/sta_cmdresp.c | 4 ++-- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h > index 7ff4ee213bea..533d4a8eb75c 100644 > --- a/drivers/net/wireless/mwifiex/fw.h > +++ b/drivers/net/wireless/mwifiex/fw.h > @@ -850,7 +850,7 @@ struct mwifiex_tkip_param { > struct mwifiex_aes_param { > u8 pn[WPA_PN_SIZE]; > __le16 key_len; > - u8 key[WLAN_KEY_LEN_CCMP]; > + u8 key[WLAN_KEY_LEN_CCMP_256]; > } __packed; > > struct mwifiex_wapi_param { > diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c > index 3ad48c72863b..c269f9ced970 100644 > --- a/drivers/net/wireless/mwifiex/sta_cmdresp.c > +++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c > @@ -631,7 +631,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, > key_v2 = &resp->params.key_material_v2; > > len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); > - if (len > WLAN_KEY_LEN_CCMP) > + if (len > sizeof(key_v2->key_param_set.key_params.aes.key)) > return -EINVAL; > > if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { > @@ -647,7 +647,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, > return 0; > > memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, > - WLAN_KEY_LEN_CCMP); > + sizeof(key_v2->key_param_set.key_params.aes.key)); > priv->aes_key_v2.key_param_set.key_params.aes.key_len = > cpu_to_le16(len); > memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, >
Acked-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com> On Sat, Sep 26, 2020 at 01:19:41AM +0800, Wen-chien Jesse Sung wrote: > From: Maximilian Luz <luzmaximilian@gmail.com> > > BugLink: https://launchpad.net/bugs/1897299 > > Following commit e18696786548 ("mwifiex: Prevent memory corruption > handling keys") the mwifiex driver fails to authenticate with certain > networks, specifically networks with 256 bit keys, and repeatedly asks > for the password. The kernel log repeats the following lines (id and > bssid redacted): > > mwifiex_pcie 0000:01:00.0: info: trying to associate to '<id>' bssid <bssid> > mwifiex_pcie 0000:01:00.0: info: associated to bssid <bssid> successfully > mwifiex_pcie 0000:01:00.0: crypto keys added > mwifiex_pcie 0000:01:00.0: info: successfully disconnected from <bssid>: reason code 3 > > Tracking down this problem lead to the overflow check introduced by the > aforementioned commit into mwifiex_ret_802_11_key_material_v2(). This > check fails on networks with 256 bit keys due to the current storage > size for AES keys in struct mwifiex_aes_param being only 128 bit. > > To fix this issue, increase the storage size for AES keys to 256 bit. > > Fixes: e18696786548 ("mwifiex: Prevent memory corruption handling keys") > Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com> > Reported-by: Kaloyan Nikolov <konik98@gmail.com> > Tested-by: Kaloyan Nikolov <konik98@gmail.com> > Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> > Reviewed-by: Brian Norris <briannorris@chromium.org> > Tested-by: Brian Norris <briannorris@chromium.org> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> > Link: https://lore.kernel.org/r/20200825153829.38043-1-luzmaximilian@gmail.com > (backported from commit 4afc850e2e9e781976fb2c7852ce7bac374af938) > Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com> > --- > drivers/net/wireless/mwifiex/fw.h | 2 +- > drivers/net/wireless/mwifiex/sta_cmdresp.c | 4 ++-- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h > index 7ff4ee213bea..533d4a8eb75c 100644 > --- a/drivers/net/wireless/mwifiex/fw.h > +++ b/drivers/net/wireless/mwifiex/fw.h > @@ -850,7 +850,7 @@ struct mwifiex_tkip_param { > struct mwifiex_aes_param { > u8 pn[WPA_PN_SIZE]; > __le16 key_len; > - u8 key[WLAN_KEY_LEN_CCMP]; > + u8 key[WLAN_KEY_LEN_CCMP_256]; > } __packed; > > struct mwifiex_wapi_param { > diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c > index 3ad48c72863b..c269f9ced970 100644 > --- a/drivers/net/wireless/mwifiex/sta_cmdresp.c > +++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c > @@ -631,7 +631,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, > key_v2 = &resp->params.key_material_v2; > > len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); > - if (len > WLAN_KEY_LEN_CCMP) > + if (len > sizeof(key_v2->key_param_set.key_params.aes.key)) > return -EINVAL; > > if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { > @@ -647,7 +647,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, > return 0; > > memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, > - WLAN_KEY_LEN_CCMP); > + sizeof(key_v2->key_param_set.key_params.aes.key)); > priv->aes_key_v2.key_param_set.key_params.aes.key_len = > cpu_to_le16(len); > memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, > -- > 2.25.1 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h index 7ff4ee213bea..533d4a8eb75c 100644 --- a/drivers/net/wireless/mwifiex/fw.h +++ b/drivers/net/wireless/mwifiex/fw.h @@ -850,7 +850,7 @@ struct mwifiex_tkip_param { struct mwifiex_aes_param { u8 pn[WPA_PN_SIZE]; __le16 key_len; - u8 key[WLAN_KEY_LEN_CCMP]; + u8 key[WLAN_KEY_LEN_CCMP_256]; } __packed; struct mwifiex_wapi_param { diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c index 3ad48c72863b..c269f9ced970 100644 --- a/drivers/net/wireless/mwifiex/sta_cmdresp.c +++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c @@ -631,7 +631,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, key_v2 = &resp->params.key_material_v2; len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); - if (len > WLAN_KEY_LEN_CCMP) + if (len > sizeof(key_v2->key_param_set.key_params.aes.key)) return -EINVAL; if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { @@ -647,7 +647,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, return 0; memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, - WLAN_KEY_LEN_CCMP); + sizeof(key_v2->key_param_set.key_params.aes.key)); priv->aes_key_v2.key_param_set.key_params.aes.key_len = cpu_to_le16(len); memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,