kernel/git/stable/linux.git/net/mac80211/key.c, branch linux-7.2.y

wifi: mac80211: allow cipher change on NAN_DATA interfaces

2026-05-20T10:03:38+00:00

ieee80211_key_link() rejects pairwise key installation when the cipher differs from the existing PTK. Per Wi-Fi Aware version 4.0 section 7.4, the ND-TKSA between the same NDI pair shall be updated when a new NDP requires a stronger cipher suite. Exempt NL80211_IFTYPE_NAN_DATA from the same-cipher enforcement so the PTK can be replaced with a different cipher. Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260515142736.3188a47a23bf.I5fba3a111ffe054b46928aefa5c2d763fef51d4d@changeid Signed-off-by: Johannes Berg

wifi: mac80211: Allow per station GTK for NAN Data interfaces

2026-05-20T10:03:00+00:00

The WiFi Aware specification (v4.0) requires that NAN devices that support security would also support per station GTK. Thus, allow per station GTK installation to the driver on NAN Data interfaces. Signed-off-by: Ilan Peer Reviewed-by: Johannes Berg Tested-by: Miriam Rachel Korenblit tested: Miriam Rachel Korenblit Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260513172418.37a8e259e611.I39bb9f3c1a65a8184124f531c18e121dc123d411@changeid Signed-off-by: Johannes Berg

wifi: mac80211: Use AES-CMAC library in ieee80211_aes_cmac()

2026-03-09T20:27:21+00:00

Now that AES-CMAC has a library API, convert the mac80211 AES-CMAC packet authentication code to use it instead of a "cmac(aes)" crypto_shash. This has multiple benefits, such as: - It's faster. The AES-CMAC code is now called directly, without unnecessary overhead such as indirect calls. - MAC calculation can no longer fail. - The AES-CMAC key struct is now a fixed size, allowing it to be embedded directly into 'struct ieee80211_key' rather than using a separate allocation. Note that although this increases the size of the 'u.cmac' field of 'struct ieee80211_key', it doesn't cause it to exceed the size of the largest variant of the union 'u'. Therefore, the size of 'struct ieee80211_key' itself is unchanged. Acked-by: Johannes Berg Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-15-ebiggers@kernel.org Signed-off-by: Eric Biggers

wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice

2026-01-20T09:01:43+00:00

In reconfig, in case the driver asks to disconnect during the reconfig, all the keys of the interface are marked as tainted. Then ieee80211_reenable_keys will loop over all the interface keys, and for each one it will a) increment crypto_tx_tailroom_needed_cnt b) call ieee80211_key_enable_hw_accel, which in turn will detect that this key is tainted, so it will mark it as "not in hardware", which is paired with crypto_tx_tailroom_needed_cnt incrementation, so we get two incrementations for each tainted key. Then we get a warning in ieee80211_free_keys. To fix it, don't increment the count in ieee80211_reenable_keys for tainted keys Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260118092821.4ca111fddcda.Id6e554f4b1c83760aa02d5a9e4e3080edb197aa2@changeid Signed-off-by: Johannes Berg

wifi: mac80211: fix key tailroom accounting leak

2025-10-20T11:57:10+00:00

For keys added by ieee80211_gtk_rekey_add(), we assume that they're already present in the hardware and set the flag KEY_FLAG_UPLOADED_TO_HARDWARE. However, setting this flag needs to be paired with decrementing the tailroom needed, which was missed. Fixes: f52a0b408ed1 ("wifi: mac80211: mark keys as uploaded when added by the driver") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251019115358.c88eafb4083e.I69e9d4d78a756a133668c55b5570cf15a4b0e6a4@changeid Signed-off-by: Johannes Berg

wifi: mac80211: don't require cipher and keylen in gtk rekey

2025-07-22T08:43:19+00:00

ieee80211_add_gtk_rekey receives a keyconf as an argument, and the cipher and keylen are taken from there to the new allocated key. But in rekey, both the cipher and the keylen should be the same as of the old key, so let ieee80211_add_gtk_rekey find those, so drivers won't have to fill it in. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250721214922.3c5c023bfae9.Ie6594ae2b4b6d5b3d536e642b349046ebfce7a5d@changeid Signed-off-by: Johannes Berg

wifi: mac80211: remove ieee80211_remove_key

2025-07-21T17:35:17+00:00

It is no longer used, remove it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250721091956.e964ceacd85c.Idecab8ef161fa58e000b3969bc936399284b79f0@changeid Signed-off-by: Johannes Berg

wifi: mac80211: don't mark keys for inactive links as uploaded

2025-07-15T09:00:39+00:00

During resume, the driver can call ieee80211_add_gtk_rekey for keys that are not programmed into the device, e.g. keys of inactive links. Don't mark such a key as uploaded to avoid removing it later from the driver/device. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.655094412b0b.Iacae31af3ba2a705da0a9baea976c2f799d65dc4@changeid Signed-off-by: Johannes Berg

wifi: mac80211: set key link ID to the deflink one

2025-01-13T14:34:09+00:00

When in non-MLO mode, the key ID was set to -1 even for keys that are not pairwise. Change the link ID to be the link ID of the deflink in this case so that drivers do not need to special cases for this. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250102161730.0c066f084677.I4a5c288465e75119edb6a0df90dddf6f30d14a02@changeid Signed-off-by: Johannes Berg

Merge tag 'wireless-2024-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

2024-10-25T09:44:41+00:00

wireless fixes for v6.12-rc5 The first set of wireless fixes for v6.12. We have been busy and have not been able to send this earlier, so there are more fixes than usual. The fixes are all over, both in stack and in drivers, but nothing special really standing out.