Patch "wifi: iwlwifi: mvm: don't set replay counters to 0xff" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    wifi: iwlwifi: mvm: don't set replay counters to 0xff

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4699f661828a9ab448530426c00da0e6a1557a6c
Author: Johannes Berg <johannes.berg@xxxxxxxxx>
Date:   Tue Feb 6 18:02:09 2024 +0200

    wifi: iwlwifi: mvm: don't set replay counters to 0xff
    
    [ Upstream commit d5bd4041cd70faf26fc9a54bd6f172537bbe77f3 ]
    
    The firmware (later) actually uses the values even for keys
    that are invalid as far as the host is concerned, later in
    rekeying, and then only sets the low 48 bits since the PNs
    are only 48 bits over the air. It does, however, compare the
    full 64 bits later, obviously causing problems.
    
    Remove the memset and use kzalloc instead to avoid any old
    heap data leaking to the firmware. We already init all the
    other fields in the struct anyway. This leaves the data set
    to zero for any unused fields, so the firmware can look at
    them safely even if they're not used right now.
    
    Fixes: 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5")
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@xxxxxxxxx>
    Link: https://msgid.link/20240206175739.462101146fef.I10f3855b99417af4247cff04af78dcbc6cb75c9c@changeid
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 2748459d12279..88f4f429d875c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -461,12 +461,10 @@ static int iwl_mvm_wowlan_config_rsc_tsc(struct iwl_mvm *mvm,
 		struct wowlan_key_rsc_v5_data data = {};
 		int i;
 
-		data.rsc = kmalloc(sizeof(*data.rsc), GFP_KERNEL);
+		data.rsc = kzalloc(sizeof(*data.rsc), GFP_KERNEL);
 		if (!data.rsc)
 			return -ENOMEM;
 
-		memset(data.rsc, 0xff, sizeof(*data.rsc));
-
 		for (i = 0; i < ARRAY_SIZE(data.rsc->mcast_key_id_map); i++)
 			data.rsc->mcast_key_id_map[i] =
 				IWL_MCAST_KEY_MAP_INVALID;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux