wifi: cfg80211: Fix use after free for wext
authorAlexander Wetzel <alexander@wetzel-home.de>
Tue, 24 Jan 2023 14:18:56 +0000 (15:18 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 10 Mar 2023 08:40:06 +0000 (09:40 +0100)
commitfd081afd21eb35b968b0330700c43ec94986e1c4
tree8961de2853cdc4c74f339fe9536f6aa7fc030ae1
parent60e49fe9b7e441161dfb093372712beac2ea0b8e
wifi: cfg80211: Fix use after free for wext

commit 015b8cc5e7c4d7bb671f1984d7b7338c310b185b upstream.

Key information in wext.connect is not reset on (re)connect and can hold
data from a previous connection.

Reset key data to avoid that drivers or mac80211 incorrectly detect a
WEP connection request and access the freed or already reused memory.

Additionally optimize cfg80211_sme_connect() and avoid an useless
schedule of conn_work.

Fixes: fffd0934b939 ("cfg80211: rework key operation")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230124141856.356646-1-alexander@wetzel-home.de
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/sme.c