wifi: cfg80211: Fix use after free for wext
authorAlexander Wetzel <alexander@wetzel-home.de>
Tue, 24 Jan 2023 14:18:56 +0000 (15:18 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 10 Mar 2023 08:34:22 +0000 (09:34 +0100)
commit22dfb21bf1cd876616d45cda1bc6daa89eec6747
treea8481f388a2edd88dffa37f4ec5d34fb7b689e75
parentb18188e87f1ca8c0fd43f845bccc89eece28d106
wifi: cfg80211: Fix use after free for wext

commit 015b8cc5e7c4d7bb671f1984d7b7338c310b185b upstream.

Key information in wext.connect is not reset on (re)connect and can hold
data from a previous connection.

Reset key data to avoid that drivers or mac80211 incorrectly detect a
WEP connection request and access the freed or already reused memory.

Additionally optimize cfg80211_sme_connect() and avoid an useless
schedule of conn_work.

Fixes: fffd0934b939 ("cfg80211: rework key operation")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230124141856.356646-1-alexander@wetzel-home.de
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/sme.c