This is a note to let you know that I've just added the patch titled mac80211: fix regression where EAPOL frames were sent in plaintext to the 5.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mac80211-fix-regression-where-eapol-frames-were-sent-in-plaintext.patch and it can be found in the queue-5.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 804fc6a2931e692f50e8e317fcb0c8887331b405 Mon Sep 17 00:00:00 2001 From: Mathy Vanhoef <Mathy.Vanhoef@xxxxxxxxxxx> Date: Mon, 19 Oct 2020 20:01:13 +0400 Subject: mac80211: fix regression where EAPOL frames were sent in plaintext From: Mathy Vanhoef <Mathy.Vanhoef@xxxxxxxxxxx> commit 804fc6a2931e692f50e8e317fcb0c8887331b405 upstream. When sending EAPOL frames via NL80211 they are treated as injected frames in mac80211. Due to commit 1df2bdba528b ("mac80211: never drop injected frames even if normally not allowed") these injected frames were not assigned a sta context in the function ieee80211_tx_dequeue, causing certain wireless network cards to always send EAPOL frames in plaintext. This may cause compatibility issues with some clients or APs, which for instance can cause the group key handshake to fail and in turn would cause the station to get disconnected. This commit fixes this regression by assigning a sta context in ieee80211_tx_dequeue to injected frames as well. Note that sending EAPOL frames in plaintext is not a security issue since they contain their own encryption and authentication protection. Cc: stable@xxxxxxxxxxxxxxx Fixes: 1df2bdba528b ("mac80211: never drop injected frames even if normally not allowed") Reported-by: Thomas Deutschmann <whissi@xxxxxxxxxx> Tested-by: Christian Hesse <list@xxxxxxxx> Tested-by: Thomas Deutschmann <whissi@xxxxxxxxxx> Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@xxxxxxxxxxx> Link: https://lore.kernel.org/r/20201019160113.350912-1-Mathy.Vanhoef@xxxxxxxxxxx Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mac80211/tx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -3613,13 +3613,14 @@ begin: tx.skb = skb; tx.sdata = vif_to_sdata(info->control.vif); - if (txq->sta && !(info->flags & IEEE80211_TX_CTL_INJECTED)) { + if (txq->sta) { tx.sta = container_of(txq->sta, struct sta_info, sta); /* * Drop unicast frames to unauthorised stations unless they are - * EAPOL frames from the local station. + * injected frames or EAPOL frames from the local station. */ - if (unlikely(ieee80211_is_data(hdr->frame_control) && + if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) && + ieee80211_is_data(hdr->frame_control) && !ieee80211_vif_is_mesh(&tx.sdata->vif) && tx.sdata->vif.type != NL80211_IFTYPE_OCB && !is_multicast_ether_addr(hdr->addr1) && Patches currently in stable-queue which might be from Mathy.Vanhoef@xxxxxxxxxxx are queue-5.9/mac80211-fix-regression-where-eapol-frames-were-sent-in-plaintext.patch