2018-02-19 12:30:48

by Johannes Berg

Subject: [PATCH] brcmfmac: reject too long PSK

From: Johannes Berg <[email protected]>

nl80211 already allows specifying 48 bytes, but brcmfmac
only supports 32. Reject keys that are too long.

Signed-off-by: Johannes Berg <[email protected]>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 15fa00d79fc6..74a83020c073 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5124,6 +5124,9 @@ static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
return -EINVAL;

+ if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
+ return -ERANGE;
+
return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
}

--
2.15.1

2018-02-21 08:44:09

by Arend Van Spriel

Subject: Re: [PATCH] brcmfmac: reject too long PSK

On 2/19/2018 1:30 PM, Johannes Berg wrote:
> From: Johannes Berg <[email protected]>
>
> nl80211 already allows specifying 48 bytes, but brcmfmac
> only supports 32. Reject keys that are too long.

Hah. Recent discussion about the key length made you look ;-) Thanks!

Acked-by: Arend van Spriel <[email protected]>
> Signed-off-by: Johannes Berg <[email protected]>
> ---
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> index 15fa00d79fc6..74a83020c073 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> @@ -5124,6 +5124,9 @@ static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
> if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
> return -EINVAL;
>
> + if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
> + return -ERANGE;
> +
> return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
> }
>
>

2018-02-27 16:24:36

by Kalle Valo

Subject: Re: brcmfmac: reject too long PSK

Johannes Berg <[email protected]> wrote:

> From: Johannes Berg <[email protected]>
>
> nl80211 already allows specifying 48 bytes, but brcmfmac
> only supports 32. Reject keys that are too long.
>
> Signed-off-by: Johannes Berg <[email protected]>
> Acked-by: Arend van Spriel <[email protected]>

Patch applied to wireless-drivers-next.git, thanks.

64d1519edc95 brcmfmac: reject too long PSK

--
https://patchwork.kernel.org/patch/10227649/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches