A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 21:54:34 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix Invalid EAPOL-Key MIC packet drop issue

Browse source 
After the roaming is offloaded to Firmware when the GTK rekey
happens in Host proper KCK should be used to verify MIC.
In WPA2 GTK rekey is offloaded to Firmware but not in WPA3 case.
In WPA3 SuiteB Firmware sends KCK in Key material extended TLV
instead of Key material TLV in Roam sync indication event, as the
Keys length is more in WPA3 SuiteB. And the Key material ext TLV
is parsed improperly in driver and the same is sent in roam+auth
event to wpa_supplicant. This wrong KCK was used to verify MIC
received in EAPOL.
This fix is to properly parse the KCK and KEK from Key buffer.

Change-Id: I57658b918bb41de2b5d2476d89b026d1f5982337
CRs-Fixed: 2713711
This commit is contained in:
Srikanth Marepalli 2020-06-19 21:57:56 +05:30 • committed by nshrivas
commit 89a9eb0370
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
core/wma/src/wma_scan_roam.c
View file

@ -2576,14 +2576,14 @@ static int wma_fill_roam_synch_buffer(tp_wma_handle wma,
kck_len = KCK_192BIT_KEY_LEN;
kek_len = KEK_256BIT_KEY_LEN;
roam_synch_ind_ptr->kek_len = kek_len;
qdf_mem_copy(roam_synch_ind_ptr->kek,
key_ft->key_buffer, kek_len);
roam_synch_ind_ptr->kck_len = kck_len;
qdf_mem_copy(roam_synch_ind_ptr->kck,
(key_ft->key_buffer + kek_len),
kck_len);
key_ft->key_buffer, kck_len);
roam_synch_ind_ptr->kek_len = kek_len;
qdf_mem_copy(roam_synch_ind_ptr->kek,
(key_ft->key_buffer + kck_len),
kek_len);
qdf_mem_copy(roam_synch_ind_ptr->replay_ctr,
(key_ft->key_buffer + kek_len + kck_len),