ACK: [B/F/G][PATCH 1/1] mwifiex: Increase AES key storage size to 256 bits

[Stefan Bader]

On 25.09.20 19:20, Wen-chien Jesse Sung wrote:
> From: Maximilian Luz <luzmaximilian at gmail.com>
> 
> BugLink: https://launchpad.net/bugs/1897299
> 
> Following commit e18696786548 ("mwifiex: Prevent memory corruption
> handling keys") the mwifiex driver fails to authenticate with certain
> networks, specifically networks with 256 bit keys, and repeatedly asks
> for the password. The kernel log repeats the following lines (id and
> bssid redacted):
> 
>     mwifiex_pcie 0000:01:00.0: info: trying to associate to '<id>' bssid <bssid>
>     mwifiex_pcie 0000:01:00.0: info: associated to bssid <bssid> successfully
>     mwifiex_pcie 0000:01:00.0: crypto keys added
>     mwifiex_pcie 0000:01:00.0: info: successfully disconnected from <bssid>: reason code 3
> 
> Tracking down this problem lead to the overflow check introduced by the
> aforementioned commit into mwifiex_ret_802_11_key_material_v2(). This
> check fails on networks with 256 bit keys due to the current storage
> size for AES keys in struct mwifiex_aes_param being only 128 bit.
> 
> To fix this issue, increase the storage size for AES keys to 256 bit.
> 
> Fixes: e18696786548 ("mwifiex: Prevent memory corruption handling keys")
> Signed-off-by: Maximilian Luz <luzmaximilian at gmail.com>
> Reported-by: Kaloyan Nikolov <konik98 at gmail.com>
> Tested-by: Kaloyan Nikolov <konik98 at gmail.com>
> Reviewed-by: Dan Carpenter <dan.carpenter at oracle.com>
> Reviewed-by: Brian Norris <briannorris at chromium.org>
> Tested-by: Brian Norris <briannorris at chromium.org>
> Signed-off-by: Kalle Valo <kvalo at codeaurora.org>
> Link: https://lore.kernel.org/r/20200825153829.38043-1-luzmaximilian@gmail.com
> (cherry picked from commit 4afc850e2e9e781976fb2c7852ce7bac374af938)
> Signed-off-by: Wen-chien Jesse Sung <jesse.sung at canonical.com>
Acked-by: Stefan Bader <stefan.bader at canonical.com>
> ---
>  drivers/net/wireless/marvell/mwifiex/fw.h          | 2 +-
>  drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 4 ++--
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
> index 799d61e038e7..d6be29dda9e2 100644
> --- a/drivers/net/wireless/marvell/mwifiex/fw.h
> +++ b/drivers/net/wireless/marvell/mwifiex/fw.h
> @@ -942,7 +942,7 @@ struct mwifiex_tkip_param {
>  struct mwifiex_aes_param {
>  	u8 pn[WPA_PN_SIZE];
>  	__le16 key_len;
> -	u8 key[WLAN_KEY_LEN_CCMP];
> +	u8 key[WLAN_KEY_LEN_CCMP_256];
>  } __packed;
>  
>  struct mwifiex_wapi_param {
> diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
> index ed9a2a1656e5..042a8528647b 100644
> --- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
> +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
> @@ -620,7 +620,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
>  	key_v2 = &resp->params.key_material_v2;
>  
>  	len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
> -	if (len > WLAN_KEY_LEN_CCMP)
> +	if (len > sizeof(key_v2->key_param_set.key_params.aes.key))
>  		return -EINVAL;
>  
>  	if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
> @@ -636,7 +636,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
>  		return 0;
>  
>  	memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
> -	       WLAN_KEY_LEN_CCMP);
> +	       sizeof(key_v2->key_param_set.key_params.aes.key));
>  	priv->aes_key_v2.key_param_set.key_params.aes.key_len =
>  				cpu_to_le16(len);
>  	memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20200928/b6919140/attachment.sig>