From 89a9eb03708adc4c9d544e7c6484264fad33264a Mon Sep 17 00:00:00 2001 From: Srikanth Marepalli Date: Fri, 19 Jun 2020 21:57:56 +0530 Subject: [PATCH] qcacld-3.0: Fix Invalid EAPOL-Key MIC packet drop issue After the roaming is offloaded to Firmware when the GTK rekey happens in Host proper KCK should be used to verify MIC. In WPA2 GTK rekey is offloaded to Firmware but not in WPA3 case. In WPA3 SuiteB Firmware sends KCK in Key material extended TLV instead of Key material TLV in Roam sync indication event, as the Keys length is more in WPA3 SuiteB. And the Key material ext TLV is parsed improperly in driver and the same is sent in roam+auth event to wpa_supplicant. This wrong KCK was used to verify MIC received in EAPOL. This fix is to properly parse the KCK and KEK from Key buffer. Change-Id: I57658b918bb41de2b5d2476d89b026d1f5982337 CRs-Fixed: 2713711 --- core/wma/src/wma_scan_roam.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index bf031286fa1a..b126d778ac9e 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -2576,14 +2576,14 @@ static int wma_fill_roam_synch_buffer(tp_wma_handle wma, kck_len = KCK_192BIT_KEY_LEN; kek_len = KEK_256BIT_KEY_LEN; - roam_synch_ind_ptr->kek_len = kek_len; - qdf_mem_copy(roam_synch_ind_ptr->kek, - key_ft->key_buffer, kek_len); - roam_synch_ind_ptr->kck_len = kck_len; qdf_mem_copy(roam_synch_ind_ptr->kck, - (key_ft->key_buffer + kek_len), - kck_len); + key_ft->key_buffer, kck_len); + + roam_synch_ind_ptr->kek_len = kek_len; + qdf_mem_copy(roam_synch_ind_ptr->kek, + (key_ft->key_buffer + kck_len), + kek_len); qdf_mem_copy(roam_synch_ind_ptr->replay_ctr, (key_ft->key_buffer + kek_len + kck_len),