From patchwork Wed Jun 20 07:58:00 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Loic Poulain X-Patchwork-Id: 10476505 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3F6B960383 for ; Wed, 20 Jun 2018 08:47:18 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2FB4828D1F for ; Wed, 20 Jun 2018 08:47:18 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2268128D08; Wed, 20 Jun 2018 08:47:18 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A9EE328D08 for ; Wed, 20 Jun 2018 08:47:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754651AbeFTIrP (ORCPT ); Wed, 20 Jun 2018 04:47:15 -0400 Received: from mail-wr0-f182.google.com ([209.85.128.182]:35409 "EHLO mail-wr0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754690AbeFTIrM (ORCPT ); Wed, 20 Jun 2018 04:47:12 -0400 Received: by mail-wr0-f182.google.com with SMTP id l8-v6so825152wrr.2 for ; Wed, 20 Jun 2018 01:47:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=yf4eoyk+uPBcxfnkbDhVhnbqef9PQzkkFTDaIRJuiBQ=; b=Jiv4hG73V4KTzKJF89TNoy3vTxK2at4S240pEPkiBIV0vw5L01KVJKtwfKXBez11GI zgysYcvwKep2Q7zDrMg1EdP354AVugP459MrBj1br1TfK4sz2mlA3/mypbpp7aiS+swI RTKfGXpdpjj4cG+Kz2O10jeAHtEr4Ky16Dc40= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=yf4eoyk+uPBcxfnkbDhVhnbqef9PQzkkFTDaIRJuiBQ=; b=FF6iszE6UlA17C0yko2d69/wnGbWSn1GOkTdX2CnKtOhbkL3YiLm4fF6dSjoMDxjDN uxOn1JlKCKAP6okareiu5ppDpq9byG76UoXoVrx6ZH7aPgSc8W4amgD6o/JWYtdKMKaD tU4lyC07r4116i0dONkOtZrPbHLz86OAJBcmJ8Di2OGNdCv4rPYRccH9LxfBDWP2qjXr o442MXHeM4WlWi4lc3MeodHs+NbHQBDgTVSirAER9BCS2eETEByB1eYhliIjmplRVD5J uKrcIWe5zKFuxKp9wfh3iNEUauDMwWqGkCzlETVuSzMC4VzShcTau8XQF+RKBgij8U6E 8vPg== X-Gm-Message-State: APt69E36r5Oh/mNYNsdjWrWyxgLCcwGRe8s8yhTZMWXH8SSmxiothaOy 7B/iorxB7mazcwX6Se6ml76p4iqQjdk= X-Google-Smtp-Source: ADUXVKIh0uf+/LX8rqgCVIFuZs3Bwak4xzuYRndEpMr/RfeKfMLU5ev6iCUmbSsd7DwlJ/OPcksowg== X-Received: by 2002:a5d:49d1:: with SMTP id t17-v6mr15676538wrs.242.1529481513103; Wed, 20 Jun 2018 00:58:33 -0700 (PDT) Received: from lpoulain-ThinkPad-T470p.home (LFbn-1-2080-109.w90-76.abo.wanadoo.fr. [90.76.145.109]) by smtp.gmail.com with ESMTPSA id 12-v6sm2806393wmt.19.2018.06.20.00.58.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 20 Jun 2018 00:58:32 -0700 (PDT) From: Loic Poulain To: kvalo@codeaurora.org Cc: wcn36xx@lists.infradead.org, linux-wireless@vger.kernel.org, linux-arm-msm@vger.kernel.org, Loic Poulain Subject: [PATCH v2 3/3] wcn36xx: Fix WEP encryption Date: Wed, 20 Jun 2018 09:58:00 +0200 Message-Id: <1529481480-13247-3-git-send-email-loic.poulain@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1529481480-13247-1-git-send-email-loic.poulain@linaro.org> References: <1529481480-13247-1-git-send-email-loic.poulain@linaro.org> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In case of WEP encryption, driver has to configure shared key for associated station(s). Note that sta pointer is NULL in case of non pairwise key, causing NULL pointer dereference with existing code (sta_priv->is_data_encrypted). Fix this by using associated sta list instead. This enables WEP support as client, WEP AP is non-functional. Signed-off-by: Loic Poulain --- v2: Commit reword, clarify Client/AP WEP status drivers/net/wireless/ath/wcn36xx/main.c | 19 +++++++++++-------- drivers/net/wireless/ath/wcn36xx/smd.c | 20 ++++++++++++++------ 2 files changed, 25 insertions(+), 14 deletions(-) diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c index 6fd0bf6..e38443e 100644 --- a/drivers/net/wireless/ath/wcn36xx/main.c +++ b/drivers/net/wireless/ath/wcn36xx/main.c @@ -493,7 +493,7 @@ static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, { struct wcn36xx *wcn = hw->priv; struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif); - struct wcn36xx_sta *sta_priv = wcn36xx_sta_to_priv(sta); + struct wcn36xx_sta *sta_priv = sta ? wcn36xx_sta_to_priv(sta) : NULL; int ret = 0; u8 key[WLAN_MAX_KEY_LEN]; @@ -570,13 +570,16 @@ static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, if ((WLAN_CIPHER_SUITE_WEP40 == key_conf->cipher) || (WLAN_CIPHER_SUITE_WEP104 == key_conf->cipher)) { - sta_priv->is_data_encrypted = true; - wcn36xx_smd_set_stakey(wcn, - vif_priv->encrypt_type, - key_conf->keyidx, - key_conf->keylen, - key, - get_sta_index(vif, sta_priv)); + list_for_each_entry(sta_priv, + &vif_priv->sta_list, list) { + sta_priv->is_data_encrypted = true; + wcn36xx_smd_set_stakey(wcn, + vif_priv->encrypt_type, + key_conf->keyidx, + key_conf->keylen, + key, + get_sta_index(vif, sta_priv)); + } } } break; diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c index b4dadf7..304a86c 100644 --- a/drivers/net/wireless/ath/wcn36xx/smd.c +++ b/drivers/net/wireless/ath/wcn36xx/smd.c @@ -1708,12 +1708,20 @@ int wcn36xx_smd_set_stakey(struct wcn36xx *wcn, msg_body.set_sta_key_params.sta_index = sta_index; msg_body.set_sta_key_params.enc_type = enc_type; - msg_body.set_sta_key_params.key[0].id = keyidx; - msg_body.set_sta_key_params.key[0].unicast = 1; - msg_body.set_sta_key_params.key[0].direction = WCN36XX_HAL_TX_RX; - msg_body.set_sta_key_params.key[0].pae_role = 0; - msg_body.set_sta_key_params.key[0].length = keylen; - memcpy(msg_body.set_sta_key_params.key[0].key, key, keylen); + if (enc_type == WCN36XX_HAL_ED_WEP104 || + enc_type == WCN36XX_HAL_ED_WEP40) { + /* Use bss key for wep (static) */ + msg_body.set_sta_key_params.def_wep_idx = keyidx; + msg_body.set_sta_key_params.wep_type = 0; + } else { + msg_body.set_sta_key_params.key[0].id = keyidx; + msg_body.set_sta_key_params.key[0].unicast = 1; + msg_body.set_sta_key_params.key[0].direction = WCN36XX_HAL_TX_RX; + msg_body.set_sta_key_params.key[0].pae_role = 0; + msg_body.set_sta_key_params.key[0].length = keylen; + memcpy(msg_body.set_sta_key_params.key[0].key, key, keylen); + } + msg_body.set_sta_key_params.single_tid_rc = 1; PREPARE_HAL_BUF(wcn->hal_buf, msg_body);