linux-kernel - [PATCH 0/2] wifi: nl80211/wilc1000: force WLAN_AKM_SUITE_SAE to big endian in NL80211_CMD_EXTERNAL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240215-nl80211_fix_akm_suites_endianness-v1-0-57e902632f9d@bootlin.com>
Date: Thu, 15 Feb 2024 15:13:51 +0100
From: Alexis Lothoré <alexis.lothore@...tlin.com>
To: Johannes Berg <johannes@...solutions.net>
Cc: Ajay Singh <ajay.kathat@...rochip.com>, Kalle Valo <kvalo@...nel.org>, 
 Thomas Petazzoni <thomas.petazzoni@...tlin.com>, 
 linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org, 
 Igor Mitsyanko <imitsyanko@...ntenna.com>, 
 Sergey Matyukevich <geomatsi@...il.com>, 
 Alexis Lothoré <alexis.lothore@...tlin.com>, 
 kernel test robot <lkp@...el.com>
Subject: [PATCH 0/2] wifi: nl80211/wilc1000: force WLAN_AKM_SUITE_SAE to
 big endian in NL80211_CMD_EXTERNAL_AUTH

This small series is the follow-up to discussions started around a sparse
warning in wilc1000 driver ([1]) and implements the solution suggested by
Johannes. It moves a historically needed conversion to be32 in nl80211 (in
NL80211_CMD_EXTERNAL_AUTH, specifically on NL80211_ATTR_AKM_SUITES property
_only_ when it is set to WLAN_AKM_SUITE_SAE) The user scenario affected by
this update is a connect process on a WPA3-protected access point with
authentication offloaded to user-space. Two drivers are affected by the
update: wilc1000 and qtnfmac. wilc1000 case is handled by a small
companion patch which also fixes the sparse warning.

For the quantenna driver, I don't really get how it manipulates AKM suites.
The only thing it currently does on it before calling nl80211 is a
le32_to_cpu. IIUC the raw value (before applying le32_to_cpu) comes from
chip/firmware:
<interrupt>
 qtnf_shm_ipc_irq_handler
  <some callbacks chains>
   qtnf_pcie_control_rx_callback
    qtnf_trans_handle_rx_ctl_packet
     qtnf_trans_event_enqueue => queue skb to processing queue

qtnf_event_work_handler <= dequeue corresponding skb to process
 qtnf_event_process_skb
  qtnf_event_parse
   qtnf_event_handle_external_auth
    cfg80211_external_auth_request => sends NL80211_CMD_EXTERNAL_AUTH

There is no cast to big endian on AKM suite at any point in this chain, but
there are plenty of leXX_to_cpu, so I assume the chip/its firmware sends
its data in little endian. Then, since the be32 conversion is _needed_ with
current wpa_supplicant, I wonder if it works at all in current state, so I
did not modify it. Or has it been tested with another supplicant (iwd ?)
which handles WLAN_AKM_SUITE_SAE differently ? Opinions (and even some
testing) are welcome for this driver, since I do not have the corresponding
hardware.

[1] https://lore.kernel.org/linux-wireless/87a5uatfl1.fsf@kernel.org/

To: Johannes Berg <johannes@...solutions.net>
Cc: Ajay Singh <ajay.kathat@...rochip.com>
Cc: Kalle Valo <kvalo@...nel.org>
Cc: Thomas Petazzoni <thomas.petazzoni@...tlin.com>
Cc: <linux-wireless@...r.kernel.org>
Cc: <linux-kernel@...r.kernel.org>
Cc: Igor Mitsyanko <imitsyanko@...ntenna.com>
Cc: Sergey Matyukevich <geomatsi@...il.com>

Signed-off-by: Alexis Lothoré <alexis.lothore@...tlin.com>
---
Alexis Lothoré (2):
      wifi: nl80211: force WLAN_AKM_SUITE_SAE in big endian in NL80211_CMD_EXTERNAL_AUTH
      wifi: wilc1000: remove AKM suite be32 conversion for external auth request

 drivers/net/wireless/microchip/wilc1000/cfg80211.c |  2 +-
 net/wireless/nl80211.c                             | 19 ++++++++++++++++++-
 2 files changed, 19 insertions(+), 2 deletions(-)
---
base-commit: a4c7842e88b0f7d937015e4588ea2a1dec33cf2c
change-id: 20240214-nl80211_fix_akm_suites_endianness-2750a5d7da83

Best regards,
-- 
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com