All of lore.kernel.org
 help / color / mirror / Atom feed
From: Waldemar Brodkorb <wbx@openadk.org>
To: buildroot@buildroot.org
Cc: Sergey Matyukevich <geomatsi@gmail.com>
Subject: Re: [Buildroot] [PATCH] package/wpa_supplicant: security bump to 2.12
Date: Sun, 16 Aug 2026 14:43:30 +0200	[thread overview]
Message-ID: <aoGwcjcKAP0U4OnW@waldemar-brodkorb.de> (raw)
In-Reply-To: <aoGO11vvqxF6VTOy@waldemar-brodkorb.de>

Hi,

forgot to add Maintainer to CC.

Waldemar Brodkorb wrote,

> See here for a Changelog:
> https://git.w1.fi/cgit/hostap/tree/wpa_supplicant/ChangeLog?id=e6386389448a4e0ec568fa7a27026e03f95bb768
> 
> Security issues fixed in this release:
> https://w1.fi/security/2026-4/incomplete-bounds-checking-of-mesh-ampe-messages-in-wpa_supplicant.txt
> https://w1.fi/security/2026-3/unexpected-sae-commit-message-contents-terminating-wpa_suppliant.txt
> https://w1.fi/security/2026-2/missing-network-context-validation-for-pmksa-caching.txt
> https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
> 
> Patches 0001 and 0002 are upstream.
> 
> Tested on Raspberry PI4 (64 Bit).
> 
> License changed:
> -Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi> and contributors
> +Copyright (c) 2002-2026, Jouni Malinen <j@w1.fi> and contributors
> 
> Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
> ---
>  ...orization-completed-on-driver-indica.patch | 55 -------------------
>  ...dware-offload-requires-Linux-headers.patch | 53 ------------------
>  package/wpa_supplicant/wpa_supplicant.hash    |  4 +-
>  package/wpa_supplicant/wpa_supplicant.mk      |  2 +-
>  4 files changed, 3 insertions(+), 111 deletions(-)
>  delete mode 100644 package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
>  delete mode 100644 package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> 
> diff --git a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch b/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
> deleted file mode 100644
> index 89954eb7c5..0000000000
> --- a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
> +++ /dev/null
> @@ -1,55 +0,0 @@
> -From 170d8a433308ee39f87af94acaef461f8e80b67b Mon Sep 17 00:00:00 2001
> -From: Janne Grunau <janne-fdr@jannau.net>
> -Date: Sun, 4 Aug 2024 13:24:42 +0200
> -Subject: [PATCH] Revert "Mark authorization completed on driver indication during 4-way HS offload"
> -
> -This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.
> -
> -Signed-off-by: Janne Grunau <janne-fdr@jannau.net>
> -Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> -
> -Upstream: not yet sent, ongoing discussion http://lists.infradead.org/pipermail/hostap/2024-August/042893.html
> -
> ----
> - wpa_supplicant/events.c | 25 ++++++++-----------------
> - 1 file changed, 8 insertions(+), 17 deletions(-)
> -
> -diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
> -index 49917f7aa..bbb3a3eda 100644
> ---- a/wpa_supplicant/events.c
> -+++ b/wpa_supplicant/events.c
> -@@ -4327,23 +4327,14 @@ static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
> - 		eapol_sm_notify_eap_success(wpa_s->eapol, true);
> - 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) &&
> - 		   wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
> --		if (already_authorized) {
> --			/*
> --			 * We are done; the driver will take care of RSN 4-way
> --			 * handshake.
> --			 */
> --			wpa_supplicant_cancel_auth_timeout(wpa_s);
> --			wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
> --			eapol_sm_notify_portValid(wpa_s->eapol, true);
> --			eapol_sm_notify_eap_success(wpa_s->eapol, true);
> --		} else {
> --			/* Update port, WPA_COMPLETED state from the
> --			 * EVENT_PORT_AUTHORIZED handler when the driver is done
> --			 * with the 4-way handshake.
> --			 */
> --			wpa_msg(wpa_s, MSG_DEBUG,
> --				"ASSOC INFO: wait for driver port authorized indication");
> --		}
> -+		/*
> -+		 * We are done; the driver will take care of RSN 4-way
> -+		 * handshake.
> -+		 */
> -+		wpa_supplicant_cancel_auth_timeout(wpa_s);
> -+		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
> -+		eapol_sm_notify_portValid(wpa_s->eapol, true);
> -+		eapol_sm_notify_eap_success(wpa_s->eapol, true);
> - 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
> - 		   wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
> - 		/*
> --- 
> -2.45.2
> -
> diff --git a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch b/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> deleted file mode 100644
> index 7330319d06..0000000000
> --- a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> +++ /dev/null
> @@ -1,53 +0,0 @@
> -From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001
> -From: Sergey Matyukevich <geomatsi@gmail.com>
> -Date: Thu, 22 Aug 2024 00:03:41 +0300
> -Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7
> -
> -Hardware offload in Linux macsec driver is enabled in compile time if
> -libnl version is >= v3.6. This is not sufficient for successful build
> -since enum 'macsec_offload' has been added to Linux header if_link.h
> -in kernels v5.6 and v5.7, see commits:
> -- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8
> -- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf
> -
> -New libnl with older Linux headers is a valid combination. This is how
> -hostapd build failure has been detected by Buildroot autobuilder, see:
> -- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/
> -
> -Extend compile time condition for the enablement of the macsec hardware
> -offload adding Linux headers version check.
> -
> -Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload")
> -Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> -
> -Upstream: https://w1.fi/cgit/hostap/commit/?id=809d9d8172db8e2a08ff639875f838b5b86d2641
> -
> ----
> - src/drivers/driver_macsec_linux.c | 4 +++-
> - 1 file changed, 3 insertions(+), 1 deletion(-)
> -
> -diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
> -index c86715498..fad47a292 100644
> ---- a/src/drivers/driver_macsec_linux.c
> -+++ b/src/drivers/driver_macsec_linux.c
> -@@ -19,6 +19,7 @@
> - #include <netlink/route/link.h>
> - #include <netlink/route/link/macsec.h>
> - #include <linux/if_macsec.h>
> -+#include <linux/version.h>
> - #include <inttypes.h>
> - 
> - #include "utils/common.h"
> -@@ -32,7 +33,8 @@
> - 
> - #define UNUSED_SCI 0xffffffffffffffff
> - 
> --#if LIBNL_VER_NUM >= LIBNL_VER(3, 6)
> -+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \
> -+     LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
> - #define LIBNL_HAS_OFFLOAD
> - #endif
> - 
> --- 
> -2.46.0
> -
> diff --git a/package/wpa_supplicant/wpa_supplicant.hash b/package/wpa_supplicant/wpa_supplicant.hash
> index 2f38dc257a..bea1e99b1f 100644
> --- a/package/wpa_supplicant/wpa_supplicant.hash
> +++ b/package/wpa_supplicant/wpa_supplicant.hash
> @@ -1,3 +1,3 @@
>  # Locally calculated
> -sha256  912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a  wpa_supplicant-2.11.tar.gz
> -sha256  f1b5992bbdd015c3ccb7faaadd62ef58ed821e15b9329bf2ceb27511ccc3f562  README
> +sha256  08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6  wpa_supplicant-2.12.tar.gz
> +sha256  83be1b142c59ccf0d6c5dde0695d8f84dfba109bea058e78ec2942389ccf327f  README
> diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
> index fe4bc34d55..93ac228947 100644
> --- a/package/wpa_supplicant/wpa_supplicant.mk
> +++ b/package/wpa_supplicant/wpa_supplicant.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -WPA_SUPPLICANT_VERSION = 2.11
> +WPA_SUPPLICANT_VERSION = 2.12
>  WPA_SUPPLICANT_SITE = http://w1.fi/releases
>  WPA_SUPPLICANT_LICENSE = BSD-3-Clause
>  WPA_SUPPLICANT_LICENSE_FILES = README
> -- 
> 2.47.3
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
> 
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

  reply	other threads:[~2026-08-16 12:43 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-16 10:20 [Buildroot] [PATCH] package/wpa_supplicant: security bump to 2.12 Waldemar Brodkorb
2026-08-16 12:43 ` Waldemar Brodkorb [this message]
2026-08-16 15:49   ` Julien Olivain via buildroot
2026-08-16 13:11 ` Julien Olivain via buildroot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aoGwcjcKAP0U4OnW@waldemar-brodkorb.de \
    --to=wbx@openadk.org \
    --cc=buildroot@buildroot.org \
    --cc=geomatsi@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.