Re: [PATCH 4.4 59/91] mac80211: mark station unauthorized before key removal

[Ben Hutchings]

On Wed, 2020-04-01 at 18:17 +0200, Greg Kroah-Hartman wrote:
> From: Johannes Berg <johannes.berg@xxxxxxxxx>
> 
> commit b16798f5b907733966fd1a558fca823b3c67e4a1 upstream.
> 
> If a station is still marked as authorized, mark it as no longer
> so before removing its keys. This allows frames transmitted to it
> to be rejected, providing additional protection against leaking
> plain text data during the disconnection flow.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Link: https://lore.kernel.org/r/20200326155133.ccb4fb0bb356.If48f0f0504efdcf16b8921f48c6d3bb2cb763c99@changeid
> Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> 
> ---
>  net/mac80211/sta_info.c |    6 ++++++
>  1 file changed, 6 insertions(+)
> 
> --- a/net/mac80211/sta_info.c
> +++ b/net/mac80211/sta_info.c
> @@ -2,6 +2,7 @@
>   * Copyright 2002-2005, Instant802 Networks, Inc.
>   * Copyright 2006-2007	Jiri Benc <jbenc@xxxxxxx>
>   * Copyright 2013-2014  Intel Mobile Communications GmbH
> + * Copyright (C) 2018-2020 Intel Corporation
>   *
>   * This program is free software; you can redistribute it and/or modify
>   * it under the terms of the GNU General Public License version 2 as
> @@ -904,6 +905,11 @@ static void __sta_info_destroy_part2(str
>  	might_sleep();
>  	lockdep_assert_held(&local->sta_mtx);
>  
> +	while (sta->sta_state == IEEE80211_STA_AUTHORIZED) {

So this should be retried forever?  Surely not.

Ben.

> +		ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
> +		WARN_ON_ONCE(ret);
> +	}
> +
>  	/* now keys can no longer be reached */
>  	ieee80211_free_sta_keys(local, sta);
>  
-- 
Ben Hutchings, Software Developer                         Codethink Ltd
https://www.codethink.co.uk/                 Dale House, 35 Dale Street
                                     Manchester, M1 2HF, United Kingdom