wifi: mt76: ignore key disable commands

BugLink: https://bugs.launchpad.net/bugs/2016879
commit e6db67fa871dee37d22701daba806bfcd4d9df49 upstream.

This helps avoid cleartext leakage of already queued or powersave buffered
packets, when a reassoc triggers the key deletion.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230330091259.61378-1-nbd@nbd.name
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
index ca50feb0b3a9d31fb768df9d1c1d8791f69f2d38..1b1358c6bb4642602f190579e1f36c1fcd79d850 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
@@ -512,15 +512,15 @@ mt7603_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
            !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
                return -EOPNOTSUPP;
 
-       if (cmd == SET_KEY) {
-               key->hw_key_idx = wcid->idx;
-               wcid->hw_key_idx = idx;
-       } else {
+       if (cmd != SET_KEY) {
                if (idx == wcid->hw_key_idx)
                        wcid->hw_key_idx = -1;
 
-               key = NULL;
+               return 0;
        }
+
+       key->hw_key_idx = wcid->idx;
+       wcid->hw_key_idx = idx;
        mt76_wcid_key_setup(&dev->mt76, wcid, key);
 
        return mt7603_wtbl_set_key(dev, wcid->idx, key);

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
index a95602473359e396f76107a6f022ff2d234405e8..51a968a6afdc9d17fdf290891f59ff2ccc6a0084 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -1193,8 +1193,7 @@ EXPORT_SYMBOL_GPL(mt7615_mac_enable_rtscts);
 static int
 mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
                           struct ieee80211_key_conf *key,
-                          enum mt76_cipher_type cipher, u16 cipher_mask,
-                          enum set_key_cmd cmd)
+                          enum mt76_cipher_type cipher, u16 cipher_mask)
 {
        u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx) + 30 * 4;
        u8 data[32] = {};
@@ -1203,27 +1202,18 @@ mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
                return -EINVAL;
 
        mt76_rr_copy(dev, addr, data, sizeof(data));
-       if (cmd == SET_KEY) {
-               if (cipher == MT_CIPHER_TKIP) {
-                       /* Rx/Tx MIC keys are swapped */
-                       memcpy(data, key->key, 16);
-                       memcpy(data + 16, key->key + 24, 8);
-                       memcpy(data + 24, key->key + 16, 8);
-               } else {
-                       if (cipher_mask == BIT(cipher))
-                               memcpy(data, key->key, key->keylen);
-                       else if (cipher != MT_CIPHER_BIP_CMAC_128)
-                               memcpy(data, key->key, 16);
-                       if (cipher == MT_CIPHER_BIP_CMAC_128)
-                               memcpy(data + 16, key->key, 16);
-               }
+       if (cipher == MT_CIPHER_TKIP) {
+               /* Rx/Tx MIC keys are swapped */
+               memcpy(data, key->key, 16);
+               memcpy(data + 16, key->key + 24, 8);
+               memcpy(data + 24, key->key + 16, 8);
        } else {
+               if (cipher_mask == BIT(cipher))
+                       memcpy(data, key->key, key->keylen);
+               else if (cipher != MT_CIPHER_BIP_CMAC_128)
+                       memcpy(data, key->key, 16);
                if (cipher == MT_CIPHER_BIP_CMAC_128)
-                       memset(data + 16, 0, 16);
-               else if (cipher_mask)
-                       memset(data, 0, 16);
-               if (!cipher_mask)
-                       memset(data, 0, sizeof(data));
+                       memcpy(data + 16, key->key, 16);
        }
 
        mt76_wr_copy(dev, addr, data, sizeof(data));
@@ -1234,7 +1224,7 @@ mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
 static int
 mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
                          enum mt76_cipher_type cipher, u16 cipher_mask,
-                         int keyidx, enum set_key_cmd cmd)
+                         int keyidx)
 {
        u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx), w0, w1;
 
@@ -1253,9 +1243,7 @@ mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
        else
                w0 &= ~MT_WTBL_W0_RX_IK_VALID;
 
-       if (cmd == SET_KEY &&
-           (cipher != MT_CIPHER_BIP_CMAC_128 ||
-            cipher_mask == BIT(cipher))) {
+       if (cipher != MT_CIPHER_BIP_CMAC_128 || cipher_mask == BIT(cipher)) {
                w0 &= ~MT_WTBL_W0_KEY_IDX;
                w0 |= FIELD_PREP(MT_WTBL_W0_KEY_IDX, keyidx);
        }
@@ -1272,19 +1260,10 @@ mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
 
 static void
 mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid,
-                             enum mt76_cipher_type cipher, u16 cipher_mask,
-                             enum set_key_cmd cmd)
+                             enum mt76_cipher_type cipher, u16 cipher_mask)
 {
        u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx);
 
-       if (!cipher_mask) {
-               mt76_clear(dev, addr + 2 * 4, MT_WTBL_W2_KEY_TYPE);
-               return;
-       }
-
-       if (cmd != SET_KEY)
-               return;
-
        if (cipher == MT_CIPHER_BIP_CMAC_128 &&
            cipher_mask & ~BIT(MT_CIPHER_BIP_CMAC_128))
                return;
@@ -1295,8 +1274,7 @@ mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid,
 
 int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
                              struct mt76_wcid *wcid,
-                             struct ieee80211_key_conf *key,
-                             enum set_key_cmd cmd)
+                             struct ieee80211_key_conf *key)
 {
        enum mt76_cipher_type cipher;
        u16 cipher_mask = wcid->cipher;
@@ -1306,19 +1284,14 @@ int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
        if (cipher == MT_CIPHER_NONE)
                return -EOPNOTSUPP;
 
-       if (cmd == SET_KEY)
-               cipher_mask |= BIT(cipher);
-       else
-               cipher_mask &= ~BIT(cipher);
-
-       mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask, cmd);
-       err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask,
-                                        cmd);
+       cipher_mask |= BIT(cipher);
+       mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask);
+       err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask);
        if (err < 0)
                return err;
 
        err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, cipher_mask,
-                                       key->keyidx, cmd);
+                                       key->keyidx);
        if (err < 0)
                return err;
 
@@ -1329,13 +1302,12 @@ int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
 
 int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
                            struct mt76_wcid *wcid,
-                           struct ieee80211_key_conf *key,
-                           enum set_key_cmd cmd)
+                           struct ieee80211_key_conf *key)
 {
        int err;
 
        spin_lock_bh(&dev->mt76.lock);
-       err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
+       err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
        spin_unlock_bh(&dev->mt76.lock);
 
        return err;

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
index ab4c1b4478aa99df2b82ea4980af4f7d1a500674..dadb13f2ca09568b7f706661146b3b90a2e1cbce 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
@@ -391,18 +391,17 @@ static int mt7615_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
        if (cmd == SET_KEY)
                *wcid_keyidx = idx;
-       else if (idx == *wcid_keyidx)
-               *wcid_keyidx = -1;
-       else
+       else {
+               if (idx == *wcid_keyidx)
+                       *wcid_keyidx = -1;
                goto out;
+       }
 
-       mt76_wcid_key_setup(&dev->mt76, wcid,
-                           cmd == SET_KEY ? key : NULL);
-
+       mt76_wcid_key_setup(&dev->mt76, wcid, key);
        if (mt76_is_mmio(&dev->mt76))
-               err = mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
+               err = mt7615_mac_wtbl_set_key(dev, wcid, key);
        else
-               err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
+               err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
 
 out:
        mt7615_mutex_release(dev);

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
index 087d4886162e625d58dfc7e3a840c842266efad2..ab10ad0ecdeddbd398c1086690129a7ce6202993 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
@@ -484,11 +484,9 @@ int mt7615_mac_write_txwi(struct mt7615_dev *dev, __le32 *txwi,
 void mt7615_mac_set_timing(struct mt7615_phy *phy);
 int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
                              struct mt76_wcid *wcid,
-                             struct ieee80211_key_conf *key,
-                             enum set_key_cmd cmd);
+                             struct ieee80211_key_conf *key);
 int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
-                           struct ieee80211_key_conf *key,
-                           enum set_key_cmd cmd);
+                           struct ieee80211_key_conf *key);
 void mt7615_mac_reset_work(struct work_struct *work);
 u32 mt7615_mac_get_sta_tid_sn(struct mt7615_dev *dev, int wcid, u8 tid);
 

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c
index 604ddcc2112315aeaa2bb198a5692804ec67ee87..324535a0dd6d457da383373ef7b0b456d9f403d6 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c
@@ -455,20 +455,20 @@ int mt76x02_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        msta = sta ? (struct mt76x02_sta *)sta->drv_priv : NULL;
        wcid = msta ? &msta->wcid : &mvif->group_wcid;
 
-       if (cmd == SET_KEY) {
-               key->hw_key_idx = wcid->idx;
-               wcid->hw_key_idx = idx;
-               if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
-                       key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
-                       wcid->sw_iv = true;
-               }
-       } else {
+       if (cmd != SET_KEY) {
                if (idx == wcid->hw_key_idx) {
                        wcid->hw_key_idx = -1;
                        wcid->sw_iv = false;
                }
 
-               key = NULL;
+               return 0;
+       }
+
+       key->hw_key_idx = wcid->idx;
+       wcid->hw_key_idx = idx;
+       if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
+               key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
+               wcid->sw_iv = true;
        }
        mt76_wcid_key_setup(&dev->mt76, wcid, key);
 

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
index 7589af4b3dab73637181deec4336fd28dfa354be..06c1045177e24e37b9976cb25ffd06baf3111aff 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
@@ -410,16 +410,15 @@ static int mt7915_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                mt7915_mcu_add_bss_info(phy, vif, true);
        }
 
-       if (cmd == SET_KEY)
+       if (cmd == SET_KEY) {
                *wcid_keyidx = idx;
-       else if (idx == *wcid_keyidx)
-               *wcid_keyidx = -1;
-       else
+       } else {
+               if (idx == *wcid_keyidx)
+                       *wcid_keyidx = -1;
                goto out;
+       }
 
-       mt76_wcid_key_setup(&dev->mt76, wcid,
-                           cmd == SET_KEY ? key : NULL);
-
+       mt76_wcid_key_setup(&dev->mt76, wcid, key);
        err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
                                      key, MCU_EXT_CMD(STA_REC_UPDATE),
                                      &msta->wcid, cmd);

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index cdb0d61903935b2854a183f4f35ae09bdb71cbf8..744382be36f8bf48b2f425624c18e501c8ef36c0 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -569,16 +569,15 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
        mt7921_mutex_acquire(dev);
 
-       if (cmd == SET_KEY)
+       if (cmd == SET_KEY) {
                *wcid_keyidx = idx;
-       else if (idx == *wcid_keyidx)
-               *wcid_keyidx = -1;
-       else
+       } else {
+               if (idx == *wcid_keyidx)
+                       *wcid_keyidx = -1;
                goto out;
+       }
 
-       mt76_wcid_key_setup(&dev->mt76, wcid,
-                           cmd == SET_KEY ? key : NULL);
-
+       mt76_wcid_key_setup(&dev->mt76, wcid, key);
        err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
                                      key, MCU_UNI_CMD(STA_REC_UPDATE),
                                      &msta->wcid, cmd);

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index c423b052e4f4c740f3ebbf7698df6642e9abb981..2734aae5449b142676b9e96838a13f31c9cd709e 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -351,16 +351,15 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                mt7996_mcu_add_bss_info(phy, vif, true);
        }
 
-       if (cmd == SET_KEY)
+       if (cmd == SET_KEY) {
                *wcid_keyidx = idx;
-       else if (idx == *wcid_keyidx)
-               *wcid_keyidx = -1;
-       else
+       } else {
+               if (idx == *wcid_keyidx)
+                       *wcid_keyidx = -1;
                goto out;
+       }
 
-       mt76_wcid_key_setup(&dev->mt76, wcid,
-                           cmd == SET_KEY ? key : NULL);
-
+       mt76_wcid_key_setup(&dev->mt76, wcid, key);
        err = mt7996_mcu_add_key(&dev->mt76, vif, &msta->bip,
                                 key, MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
                                 &msta->wcid, cmd);