Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2bc34fac authored by Hector Martin's avatar Hector Martin Committed by Greg Kroah-Hartman
Browse files

wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex 



[ Upstream commit 89b89e52153fda2733562776c7c9d9d3ebf8dd6d ]

Apparently the hex passphrase mechanism does not work on newer
chips/firmware (e.g. BCM4387). It seems there was a simple way of
passing it in binary all along, so use that and avoid the hexification.

OpenBSD has been doing it like this from the beginning, so this should
work on all chips.

Also clear the structure before setting the PMK. This was leaking
uninitialized stack contents to the device.

Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Reviewed-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: default avatarHector Martin <marcan@marcan.st>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230214092423.15175-6-marcan@marcan.st


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 35d67ffa

drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

+7 −6
Original line number Diff line number Diff line
@@ -1238,13 +1238,14 @@ static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e) 
static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)

{

	struct brcmf_wsec_pmk_le pmk;

	int i, err;

	int err;



	memset(&pmk, 0, sizeof(pmk));



	/* convert to firmware key format */

	pmk.key_len = cpu_to_le16(pmk_len << 1);

	pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);

	for (i = 0; i < pmk_len; i++)

		snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);

	/* pass pmk directly */

	pmk.key_len = cpu_to_le16(pmk_len);

	pmk.flags = cpu_to_le16(0);

	memcpy(pmk.key, pmk_data, pmk_len);



	/* store psk in firmware */

	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,