Commit b16798f5 authored by Johannes Berg's avatar Johannes Berg

mac80211: mark station unauthorized before key removal

If a station is still marked as authorized, mark it as no longer
so before removing its keys. This allows frames transmitted to it
to be rejected, providing additional protection against leaking
plain text data during the disconnection flow.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200326155133.ccb4fb0bb356.If48f0f0504efdcf16b8921f48c6d3bb2cb763c99@changeidSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent ce2e1ca7
...@@ -4,7 +4,7 @@ ...@@ -4,7 +4,7 @@
* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
* Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright (C) 2015 - 2017 Intel Deutschland GmbH * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
* Copyright (C) 2018-2019 Intel Corporation * Copyright (C) 2018-2020 Intel Corporation
*/ */
#include <linux/module.h> #include <linux/module.h>
...@@ -1049,6 +1049,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta) ...@@ -1049,6 +1049,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
might_sleep(); might_sleep();
lockdep_assert_held(&local->sta_mtx); lockdep_assert_held(&local->sta_mtx);
while (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
WARN_ON_ONCE(ret);
}
/* now keys can no longer be reached */ /* now keys can no longer be reached */
ieee80211_free_sta_keys(local, sta); ieee80211_free_sta_keys(local, sta);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment