linux-kernel - Re: [PATCH 4.4 59/91] mac80211: mark station unauthorized before key removal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b7a947dbf4222028149b12c9d63cfa2334664645.camel@codethink.co.uk>
Date:   Thu, 02 Apr 2020 15:13:02 +0100
From:   Ben Hutchings <ben.hutchings@...ethink.co.uk>
To:     Johannes Berg <johannes.berg@...el.com>
Cc:     stable@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 4.4 59/91] mac80211: mark station unauthorized before
 key removal

On Wed, 2020-04-01 at 18:17 +0200, Greg Kroah-Hartman wrote:
> From: Johannes Berg <johannes.berg@...el.com>
> 
> commit b16798f5b907733966fd1a558fca823b3c67e4a1 upstream.
> 
> If a station is still marked as authorized, mark it as no longer
> so before removing its keys. This allows frames transmitted to it
> to be rejected, providing additional protection against leaking
> plain text data during the disconnection flow.
> 
> Cc: stable@...r.kernel.org
> Link: https://lore.kernel.org/r/20200326155133.ccb4fb0bb356.If48f0f0504efdcf16b8921f48c6d3bb2cb763c99@changeid
> Signed-off-by: Johannes Berg <johannes.berg@...el.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> 
> ---
>  net/mac80211/sta_info.c |    6 ++++++
>  1 file changed, 6 insertions(+)
> 
> --- a/net/mac80211/sta_info.c
> +++ b/net/mac80211/sta_info.c
> @@ -2,6 +2,7 @@
>   * Copyright 2002-2005, Instant802 Networks, Inc.
>   * Copyright 2006-2007	Jiri Benc <jbenc@...e.cz>
>   * Copyright 2013-2014  Intel Mobile Communications GmbH
> + * Copyright (C) 2018-2020 Intel Corporation
>   *
>   * This program is free software; you can redistribute it and/or modify
>   * it under the terms of the GNU General Public License version 2 as
> @@ -904,6 +905,11 @@ static void __sta_info_destroy_part2(str
>  	might_sleep();
>  	lockdep_assert_held(&local->sta_mtx);
>  
> +	while (sta->sta_state == IEEE80211_STA_AUTHORIZED) {

So this should be retried forever?  Surely not.

Ben.

> +		ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
> +		WARN_ON_ONCE(ret);
> +	}
> +
>  	/* now keys can no longer be reached */
>  	ieee80211_free_sta_keys(local, sta);
>  
-- 
Ben Hutchings, Software Developer                         Codethink Ltd
https://www.codethink.co.uk/                 Dale House, 35 Dale Street
                                     Manchester, M1 2HF, United Kingdom