diff mbox series

[5.10,049/289] mt76: mt76x0: disable GTK offloading

Message ID	20210517140306.848107399@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, David Bauer <mail@david-bauer.net>, Felix Fietkau <nbd@nbd.name>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 049/289] mt76: mt76x0: disable GTK offloading Date: Mon, 17 May 2021 15:59:34 +0200 Message-Id: <20210517140306.848107399@linuxfoundation.org> In-Reply-To: <20210517140305.140529752@linuxfoundation.org> References: <20210517140305.140529752@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/289] tpm: fix error return code in tpm2_get_cc_attrs_tbl() [5.10,003/289] tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() [5.10,005/289] KVM: x86/mmu: Remove the defunct update_pte() paging hook [5.10,006/289] KVM/VMX: Invoke NMI non-IST entry instead of IST entry [5.10,007/289] ACPI: PM: Add ACPI ID of Alder Lake Fan [5.10,008/289] PM: runtime: Fix unpaired parent child_count for force_resume [5.10,010/289] kvm: Cap halt polling at kvm->max_halt_poll_ns [5.10,011/289] ath11k: fix thermal temperature read [5.10,012/289] fs: dlm: fix debugfs dump [5.10,013/289] fs: dlm: add errno handling to check callback [5.10,015/289] fs: dlm: flush swork on shutdown [5.10,017/289] ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF [5.10,022/289] i2c: bail out early when RDWR parameters are wrong [5.10,028/289] Bluetooth: initialize skb_queue_head at l2cap_chan_create() [5.10,029/289] net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports [5.10,030/289] net: bridge: when suppression is enabled exclude RARP packets [5.10,031/289] Bluetooth: check for zapped sk before connecting [5.10,034/289] net: hns3: remediate a potential overflow risk of bd_num_list [5.10,036/289] ip6_vti: proper dev_{hold\|put} in ndo_[un]init methods [5.10,037/289] ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet [5.10,040/289] ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055 [5.10,041/289] i2c: Add I2C_AQ_NO_REP_START adapter quirk [5.10,043/289] coresight: Do not scan for graph if none is present [5.10,044/289] IB/hfi1: Correct oversized ring allocation [5.10,046/289] pinctrl: samsung: use int for register masks in Exynos [5.10,049/289] mt76: mt76x0: disable GTK offloading [5.10,051/289] fuse: invalidate attrs when page writeback completes [5.10,053/289] cuse: prevent clone [5.10,054/289] iwlwifi: pcie: make cfg vs. trans_cfg more robust [5.10,055/289] powerpc/mm: Add cond_resched() while removing hpte mappings [5.10,056/289] ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() [5.10,057/289] Revert "iommu/amd: Fix performance counter initialization" [5.10,060/289] selftests: Set CC to clang in lib.mk if LLVM is set [5.10,065/289] sctp: Fix out-of-bounds warning in sctp_process_asconf_param() [5.10,066/289] flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target() [5.10,067/289] powerpc/smp: Set numa node before updating mask [5.10,070/289] net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule [5.10,073/289] drm/amd/display: fixed divide by zero kernel crash during dsc enablement [5.10,074/289] drm/amd/display: add handling for hdcp2 rx id list validation [5.10,075/289] drm/amdgpu: Add mem sync flag for IB allocated by SA [5.10,076/289] mt76: mt7615: fix entering driver-own state on mt7663 [5.10,077/289] crypto: ccp: Free SEV device if SEV init fails [5.10,078/289] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt [5.10,079/289] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join [5.10,082/289] iavf: remove duplicate free resources calls [5.10,083/289] net: ethernet: mtk_eth_soc: fix RX VLAN offload [5.10,085/289] selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test [5.10,086/289] kbuild: generate Module.symvers only when vmlinux exists [5.10,089/289] watchdog: rename __touch_watchdog() to a better descriptive name [5.10,090/289] watchdog: explicitly update timestamp when reporting softlockup [5.10,091/289] watchdog/softlockup: remove logic that tried to prevent repeated reports [5.10,093/289] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable [5.10,096/289] f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE [5.10,098/289] f2fs: fix panic during f2fs_resize_fs() [5.10,101/289] remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader [5.10,103/289] PCI: Release OF node in pci_scan_device()s error path [5.10,104/289] ARM: 9064/1: hw_breakpoint: Do not directly check the events overflow_handler hook [5.10,105/289] f2fs: fix to align to section for fallocate() on pinned file [5.10,110/289] PCI: endpoint: Fix NULL pointer dereference for ->get_features() [5.10,113/289] f2fs: Fix a hungtask problem in atomic write [5.10,114/289] f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block() [5.10,119/289] NFS: Deal correctly with attribute generation counter overflow [5.10,120/289] PCI: endpoint: Fix missing destroy_workqueue() [5.10,121/289] pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() [5.10,123/289] SUNRPC: Move fault injection call sites [5.10,126/289] thermal/drivers/tsens: Fix missing put_device error [5.10,128/289] nfsd: ensure new clients break delegations [5.10,131/289] dmaengine: idxd: fix dma device lifetime [5.10,132/289] dmaengine: idxd: fix cdev setup and free device lifetime issues [5.10,133/289] SUNRPC: fix ternary sign expansion bug in tracing [5.10,134/289] pwm: atmel: Fix duty cycle calculation in .get_state() [5.10,137/289] xprtrdma: rpcrdma_mr_pop() already does list_del_init() [5.10,142/289] scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend [5.10,143/289] scsi: ufs: core: Narrow down fast path in system suspend path [5.10,144/289] rtc: ds1307: Fix wday settings for rx8130 [5.10,145/289] net: hns3: fix incorrect configuration for igu_egu_hw_err [5.10,150/289] net: hns3: disable phy loopback setting in hclge_mac_start_phy [5.10,152/289] RISC-V: Fix error code returned by riscv_hartid_to_cpuid() [5.10,154/289] libbpf: Fix signed overflow in ringbuf_process_ring [5.10,156/289] block/rnbd-clt: Check the return value of the function rtrs_clt_query [5.10,157/289] ethernet:enic: Fix a use after free bug in enic_hard_start_xmit [5.10,162/289] drm/radeon: Fix off-by-one power_state index heap overwrite [5.10,164/289] arm64: entry: factor irq triage logic into macros [5.10,165/289] arm64: entry: always set GIC_PRIO_PSR_I_SET during entry [5.10,167/289] mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() [5.10,169/289] ksm: fix potential missing rmap_item for stable_node [5.10,171/289] mm/gup: return an error on migration failure [5.10,172/289] mm/gup: check for isolation errors [5.10,175/289] smc: disallow TCP_ULP in smc_setsockopt() [5.10,176/289] netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check [5.10,177/289] netfilter: nftables: Fix a memleak from userdata error path in new objects [5.10,178/289] can: mcp251xfd: mcp251xfd_probe(): add missing can_rx_offload_del() in error path [5.10,183/289] fs/proc/generic.c: fix incorrect pde_is_permanent check [5.10,188/289] i40e: fix broken XDP support [5.10,191/289] i40e: Fix PHY type identifiers for 2.5G and 5G adapters [5.10,193/289] f2fs: avoid unneeded data copy in f2fs_ioc_move_range() [5.10,194/289] ARC: entry: fix off-by-one error in syscall number validation [5.10,198/289] powerpc/64s: Fix crashes when toggling entry flush barrier [5.10,206/289] arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache() [5.10,208/289] drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are conn... [5.10,209/289] drm/amd/display: Initialize attribute for hdcp_srm sysfs file [5.10,210/289] drm/i915: Avoid div-by-zero on gen2 [5.10,213/289] drm/msm/dp: initialize audio_comp when audio starts [5.10,214/289] KVM: x86: Cancel pvclock_gtod_work on module removal [5.10,215/289] KVM: x86: Prevent deadlock against tk_core.seq [5.10,216/289] dax: Add an enum for specifying dax wakup mode [5.10,218/289] dax: Wake up all waiters after invalidating dax entry [5.10,220/289] xen/unpopulated-alloc: fix error return code in fill_list() [5.10,222/289] usb: dwc3: gadget: Free gadget structure only after freeing endpoints [5.10,223/289] iio: light: gp2ap002: Fix rumtime PM imbalance on error [5.10,226/289] usb: fotg210-hcd: Fix an error message [5.10,227/289] hwmon: (occ) Fix poll rate limiting [5.10,229/289] ACPI: scan: Fix a memory leak in an error handling path [5.10,231/289] nvmet: add lba to sect conversion helpers [5.10,233/289] nvmet-rdma: Fix NULL deref when SEND is completed with error [5.10,234/289] f2fs: compress: fix to free compress page correctly [5.10,237/289] nbd: Fix NULL pointer in flush_workqueue [5.10,239/289] blk-mq: Swap two calls in blk_mq_exit_queue() [5.10,240/289] usb: dwc3: omap: improve extcon initialization [5.10,242/289] usb: xhci: Increase timeout for HC halt [5.10,244/289] usb: core: hub: fix race condition about TRSMRCY of resume [5.10,245/289] usb: dwc3: gadget: Enable suspend events [5.10,248/289] usb: typec: ucsi: Put fwnode in any case during ->probe() [5.10,249/289] xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI [5.10,251/289] xhci: Add reset resume quirk for AMD xhci controller. [5.10,256/289] KVM: x86: Emulate RDPID only if RDTSCP is supported [5.10,259/289] KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported [5.10,260/289] KVM: VMX: Disable preemption when probing user return MSRs [5.10,264/289] iommu/vt-d: Remove WO permissions on second-level paging entries [5.10,266/289] MIPS: Reinstate platform `__div64_32 handler [5.10,269/289] clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue [5.10,271/289] ARM: 9011/1: centralize phys-to-virt conversion of DT/ATAGS address [5.10,272/289] ARM: 9012/1: move device tree mapping out of linear region [5.10,274/289] ARM: 9027/1: head.S: explicitly map DT even if it lives in the first physical section [5.10,276/289] kobject_uevent: remove warning in init_uevent_argv() [5.10,277/289] drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp [5.10,280/289] drm/i915: Fix crash in auto_retire [5.10,281/289] clk: exynos7: Mark aclk_fsys1_200 as critical [5.10,285/289] dt-bindings: serial: 8250: Remove duplicated compatible strings [5.10,286/289] debugfs: Make debugfs_allow RO after init [5.10,287/289] ext4: fix debug format string warning [5.10,289/289] ASoC: rsnd: check all BUSIF status when error

Commit Message

Greg KH May 17, 2021, 1:59 p.m. UTC

From: David Bauer <mail@david-bauer.net>

[ Upstream commit 4b36cc6b390f18dbc59a45fb4141f90d7dfe2b23 ]

When operating two VAP on a MT7610 with encryption (PSK2, SAE, OWE),
only the first one to be created will transmit properly encrypteded
frames.

All subsequently created VAPs will sent out frames with the payload left
unencrypted, breaking multicast traffic (ICMP6 NDP) and potentially
disclosing information to a third party.

Disable GTK offloading and encrypt these frames in software to
circumvent this issue. THis only seems to be necessary on MT7610 chips,
as MT7612 is not affected from our testing.

Signed-off-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt76x02_util.c | 4 ++++
 1 file changed, 4 insertions(+)

diff mbox series

Patch

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c
index 11b769af2f8f..0f191bd28417 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c
@@ -446,6 +446,10 @@  int mt76x02_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
 		return -EOPNOTSUPP;
 
+	/* MT76x0 GTK offloading does not work with more than one VIF */
+	if (is_mt76x0(dev) && !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+		return -EOPNOTSUPP;
+
 	msta = sta ? (struct mt76x02_sta *)sta->drv_priv : NULL;
 	wcid = msta ? &msta->wcid : &mvif->group_wcid;