package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch

   1 From 07dc42ff9b9c38eae221b36acda7134ab8670af8 Mon Sep 17 00:00:00 2001
   2 From: Jouni Malinen <jouni@codeaurora.org>
   3 Date: Thu, 26 Mar 2020 15:51:34 +0100
   4 Subject: [PATCH] mac80211: Check port authorization in the
   5  ieee80211_tx_dequeue() case
   6
   7 commit ce2e1ca703071723ca2dd94d492a5ab6d15050da upstream.
   8
   9 mac80211 used to check port authorization in the Data frame enqueue case
  10 when going through start_xmit(). However, that authorization status may
  11 change while the frame is waiting in a queue. Add a similar check in the
  12 dequeue case to avoid sending previously accepted frames after
  13 authorization change. This provides additional protection against
  14 potential leaking of frames after a station has been disconnected and
  15 the keys for it are being removed.
  16
  17 Cc: stable@vger.kernel.org
  18 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
  19 Link: https://lore.kernel.org/r/20200326155133.ced84317ea29.I34d4c47cd8cc8a4042b38a76f16a601fbcbfd9b3@changeid
  20 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22 ---
  23  net/mac80211/tx.c | 19 ++++++++++++++++++-
  24  1 file changed, 18 insertions(+), 1 deletion(-)
  25
  26 --- a/net/mac80211/tx.c
  27 +++ b/net/mac80211/tx.c
  28 @@ -3496,8 +3496,25 @@ begin:
  29         tx.sdata = vif_to_sdata(info->control.vif);
  30         tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
  31
  32 -       if (txq->sta)
  33 +       if (txq->sta) {
  34                 tx.sta = container_of(txq->sta, struct sta_info, sta);
  35 +               /*
  36 +                * Drop unicast frames to unauthorised stations unless they are
  37 +                * EAPOL frames from the local station.
  38 +                */
  39 +               if (unlikely(!ieee80211_vif_is_mesh(&tx.sdata->vif) &&
  40 +                            tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
  41 +                            !is_multicast_ether_addr(hdr->addr1) &&
  42 +                            !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) &&
  43 +                            (!(info->control.flags &
  44 +                               IEEE80211_TX_CTRL_PORT_CTRL_PROTO) ||
  45 +                             !ether_addr_equal(tx.sdata->vif.addr,
  46 +                                               hdr->addr2)))) {
  47 +                       I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
  48 +                       ieee80211_free_txskb(&local->hw, skb);
  49 +                       goto begin;
  50 +               }
  51 +       }
  52
  53         /*
  54          * The key can be removed while the packet was queued, so need to call