[][mac80211][mt76][wifi6][fix key used-after-free issue]
[Description]
Fix the issue that the key might be used in TX path after being freed.
[Release-log]
N/A
Change-Id: I8f82c2c7c4f149e7e8affa9ee103adb3cef1ac7f
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/9824599
diff --git a/autobuild/autobuild_5.4_mac80211_release/package/kernel/mt76/patches/2016-wifi-mt76-mt7915-fix-key-used-after-free-issue.patch b/autobuild/autobuild_5.4_mac80211_release/package/kernel/mt76/patches/2016-wifi-mt76-mt7915-fix-key-used-after-free-issue.patch
new file mode 100644
index 0000000..b9ac679
--- /dev/null
+++ b/autobuild/autobuild_5.4_mac80211_release/package/kernel/mt76/patches/2016-wifi-mt76-mt7915-fix-key-used-after-free-issue.patch
@@ -0,0 +1,30 @@
+From 4753d2a36d752d0499b26814c133717442b99384 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 30 Oct 2024 17:44:53 +0800
+Subject: [PATCH] mtk: mt76: mt7915: fix key used-after-free issue
+
+Fix the issue that the key might be used in TX path after being freed.
+
+CR-Id: WCNCR00289305
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ mt76_connac_mac.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index b80872e..a1a9e5d 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -433,8 +433,7 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
+ FIELD_PREP(MT_TXD2_SUB_TYPE, fc_stype) |
+ FIELD_PREP(MT_TXD2_MULTICAST, multicast);
+
+- if (key && multicast && ieee80211_is_robust_mgmt_frame(skb) &&
+- key->cipher == WLAN_CIPHER_SUITE_AES_CMAC) {
++ if (key && multicast && ieee80211_is_robust_mgmt_frame(skb)) {
+ val |= MT_TXD2_BIP;
+ txwi[3] &= ~cpu_to_le32(MT_TXD3_PROTECT_FRAME);
+ }
+--
+2.25.1
+