• David Bauer's avatar
    mac80211: drop data frames without key on encrypted links · 0f1b5ce2
    David Bauer authored
    
    
    If we know that we have an encrypted link (based on having had
    a key configured for TX in the past) then drop all data frames
    in the key selection handler if there's no key anymore.
    
    This fixes an issue with mac80211 internal TXQs - there we can
    buffer frames for an encrypted link, but then if the key is no
    longer there when they're dequeued, the frames are sent without
    encryption. This happens if a station is disconnected while the
    frames are still on the TXQ.
    
    Detecting that a link should be encrypted based on a first key
    having been configured for TX is fine as there are no use cases
    for a connection going from with encryption to no encryption.
    With extended key IDs, however, there is a case of having a key
    configured for only decryption, so we can't just trigger this
    behaviour on a key being configured.
    
    Cc: stable@vger.kernel.org
    Reported-by: default avatarJouni Malinen <j@w1.fi>
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
    Signed-off-by: default avatarDavid Bauer <mail@david-bauer.net>
    0f1b5ce2