Verified Commit dffcc655 authored by Jan Pavlinec's avatar Jan Pavlinec
Browse files

patches/openwrt: add backport mac80211 patches for CVE-2020-3702

parent 964d1de1
Pipeline #81854 passed with stages
in 11 minutes and 6 seconds
From 164980a5e24b69b92686ee69ce541ae40b19e9d0 Mon Sep 17 00:00:00 2001
From: Jan Pavlinec <jan.pavlinec@nic.cz>
Date: Tue, 9 Mar 2021 16:17:17 +0100
Subject: [PATCH] mac80211: backport patch to drop data frames without key on
encrypted link
Notes:
This is part of fixes which should fix CVE-2020-3702
Backported from kernel commit a0761a301746ec2d92d7fcb82af69c0a6a4339aa
---
...ta-frames-without-key-on-encrypted-l.patch | 116 ++++++++++++++++++
1 file changed, 116 insertions(+)
create mode 100644 package/kernel/mac80211/patches/subsys/010-mac80211-drop-data-frames-without-key-on-encrypted-l.patch
diff --git a/package/kernel/mac80211/patches/subsys/010-mac80211-drop-data-frames-without-key-on-encrypted-l.patch b/package/kernel/mac80211/patches/subsys/010-mac80211-drop-data-frames-without-key-on-encrypted-l.patch
new file mode 100644
index 0000000000..370cd6ee9e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/010-mac80211-drop-data-frames-without-key-on-encrypted-l.patch
@@ -0,0 +1,116 @@
+From 189da5743e28d0c5d211b70b4cb06ce3aff77d86 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 26 Mar 2020 15:09:42 +0200
+Subject: [PATCH] mac80211: drop data frames without key on encrypted links
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit a0761a301746ec2d92d7fcb82af69c0a6a4339aa upstream.
+
+If we know that we have an encrypted link (based on having had
+a key configured for TX in the past) then drop all data frames
+in the key selection handler if there's no key anymore.
+
+This fixes an issue with mac80211 internal TXQs - there we can
+buffer frames for an encrypted link, but then if the key is no
+longer there when they're dequeued, the frames are sent without
+encryption. This happens if a station is disconnected while the
+frames are still on the TXQ.
+
+Detecting that a link should be encrypted based on a first key
+having been configured for TX is fine as there are no use cases
+for a connection going from with encryption to no encryption.
+With extended key IDs, however, there is a case of having a key
+configured for only decryption, so we can't just trigger this
+behaviour on a key being configured.
+
+Cc: stable@vger.kernel.org
+Reported-by: Jouni Malinen <j@w1.fi>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20200326150855.6865c7f28a14.I9fb1d911b064262d33e33dfba730cdeef83926ca@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/debugfs_sta.c | 1 +
+ net/mac80211/key.c | 7 +++++--
+ net/mac80211/sta_info.h | 1 +
+ net/mac80211/tx.c | 12 +++++++++---
+ 4 files changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
+index 4105081dc1df..6f390c2e4c8e 100644
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -80,6 +80,7 @@ static const char * const sta_flag_names[] = {
+ FLAG(MPSP_OWNER),
+ FLAG(MPSP_RECIPIENT),
+ FLAG(PS_DELIVER),
++ FLAG(USES_ENCRYPTION),
+ #undef FLAG
+ };
+
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index f20bb39f492d..217db25a1afa 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -341,8 +341,11 @@ static void ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
+ if (sta) {
+ if (pairwise) {
+ rcu_assign_pointer(sta->ptk[idx], new);
+- sta->ptk_idx = idx;
+- ieee80211_check_fast_xmit(sta);
++ if (new) {
++ set_sta_flag(new->sta, WLAN_STA_USES_ENCRYPTION);
++ new->sta->ptk_idx = new->conf.keyidx;
++ ieee80211_check_fast_xmit(new->sta);
++ }
+ } else {
+ rcu_assign_pointer(sta->gtk[idx], new);
+ }
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index 9a04327d71d1..075609c4571d 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -101,6 +101,7 @@ enum ieee80211_sta_info_flags {
+ WLAN_STA_MPSP_OWNER,
+ WLAN_STA_MPSP_RECIPIENT,
+ WLAN_STA_PS_DELIVER,
++ WLAN_STA_USES_ENCRYPTION,
+
+ NUM_WLAN_STA_FLAGS,
+ };
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 98d048630ad2..3530d1a5fc98 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -593,10 +593,13 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+
+- if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
++ if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {
+ tx->key = NULL;
+- else if (tx->sta &&
+- (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
++ return TX_CONTINUE;
++ }
++
++ if (tx->sta &&
++ (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
+ tx->key = key;
+ else if (ieee80211_is_group_privacy_action(tx->skb) &&
+ (key = rcu_dereference(tx->sdata->default_multicast_key)))
+@@ -657,6 +660,9 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
+ if (!skip_hw && tx->key &&
+ tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+ info->control.hw_key = &tx->key->conf;
++ } else if (!ieee80211_is_mgmt(hdr->frame_control) && tx->sta &&
++ test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {
++ return TX_DROP;
+ }
+
+ return TX_CONTINUE;
+--
+2.20.1
+
--
2.17.1
From 151543f59ad016a1d5d9cd36eb9c6f44907294d4 Mon Sep 17 00:00:00 2001
From: Jan Pavlinec <jan.pavlinec@nic.cz>
Date: Tue, 9 Mar 2021 16:44:33 +0100
Subject: [PATCH] mac80211: bump PKG_RELEASE
---
package/kernel/mac80211/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index e7ab90d..a53414e 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=mac80211
PKG_VERSION:=4.19.189-1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v4.19.189/
PKG_HASH:=34a53f743b43cbb25c8e665c3932d8cdd79aa3c081b9e573fae63b5a7407422c
--
2.25.1
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment