Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Waldemar Brodkorb <wbx@openadk.org>
To: buildroot@buildroot.org
Subject: [Buildroot] [PATCH] package/wpa_supplicant: security bump to 2.12
Date: Sun, 16 Aug 2026 12:20:07 +0200	[thread overview]
Message-ID: <aoGO11vvqxF6VTOy@waldemar-brodkorb.de> (raw)

See here for a Changelog:
https://git.w1.fi/cgit/hostap/tree/wpa_supplicant/ChangeLog?id=e6386389448a4e0ec568fa7a27026e03f95bb768

Security issues fixed in this release:
https://w1.fi/security/2026-4/incomplete-bounds-checking-of-mesh-ampe-messages-in-wpa_supplicant.txt
https://w1.fi/security/2026-3/unexpected-sae-commit-message-contents-terminating-wpa_suppliant.txt
https://w1.fi/security/2026-2/missing-network-context-validation-for-pmksa-caching.txt
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt

Patches 0001 and 0002 are upstream.

Tested on Raspberry PI4 (64 Bit).

License changed:
-Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi> and contributors
+Copyright (c) 2002-2026, Jouni Malinen <j@w1.fi> and contributors

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
---
 ...orization-completed-on-driver-indica.patch | 55 -------------------
 ...dware-offload-requires-Linux-headers.patch | 53 ------------------
 package/wpa_supplicant/wpa_supplicant.hash    |  4 +-
 package/wpa_supplicant/wpa_supplicant.mk      |  2 +-
 4 files changed, 3 insertions(+), 111 deletions(-)
 delete mode 100644 package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
 delete mode 100644 package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch

diff --git a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch b/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
deleted file mode 100644
index 89954eb7c5..0000000000
--- a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 170d8a433308ee39f87af94acaef461f8e80b67b Mon Sep 17 00:00:00 2001
-From: Janne Grunau <janne-fdr@jannau.net>
-Date: Sun, 4 Aug 2024 13:24:42 +0200
-Subject: [PATCH] Revert "Mark authorization completed on driver indication during 4-way HS offload"
-
-This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.
-
-Signed-off-by: Janne Grunau <janne-fdr@jannau.net>
-Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
-
-Upstream: not yet sent, ongoing discussion http://lists.infradead.org/pipermail/hostap/2024-August/042893.html
-
----
- wpa_supplicant/events.c | 25 ++++++++-----------------
- 1 file changed, 8 insertions(+), 17 deletions(-)
-
-diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
-index 49917f7aa..bbb3a3eda 100644
---- a/wpa_supplicant/events.c
-+++ b/wpa_supplicant/events.c
-@@ -4327,23 +4327,14 @@ static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
- 		eapol_sm_notify_eap_success(wpa_s->eapol, true);
- 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) &&
- 		   wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
--		if (already_authorized) {
--			/*
--			 * We are done; the driver will take care of RSN 4-way
--			 * handshake.
--			 */
--			wpa_supplicant_cancel_auth_timeout(wpa_s);
--			wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
--			eapol_sm_notify_portValid(wpa_s->eapol, true);
--			eapol_sm_notify_eap_success(wpa_s->eapol, true);
--		} else {
--			/* Update port, WPA_COMPLETED state from the
--			 * EVENT_PORT_AUTHORIZED handler when the driver is done
--			 * with the 4-way handshake.
--			 */
--			wpa_msg(wpa_s, MSG_DEBUG,
--				"ASSOC INFO: wait for driver port authorized indication");
--		}
-+		/*
-+		 * We are done; the driver will take care of RSN 4-way
-+		 * handshake.
-+		 */
-+		wpa_supplicant_cancel_auth_timeout(wpa_s);
-+		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
-+		eapol_sm_notify_portValid(wpa_s->eapol, true);
-+		eapol_sm_notify_eap_success(wpa_s->eapol, true);
- 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
- 		   wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
- 		/*
--- 
-2.45.2
-
diff --git a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch b/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
deleted file mode 100644
index 7330319d06..0000000000
--- a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001
-From: Sergey Matyukevich <geomatsi@gmail.com>
-Date: Thu, 22 Aug 2024 00:03:41 +0300
-Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7
-
-Hardware offload in Linux macsec driver is enabled in compile time if
-libnl version is >= v3.6. This is not sufficient for successful build
-since enum 'macsec_offload' has been added to Linux header if_link.h
-in kernels v5.6 and v5.7, see commits:
-- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8
-- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf
-
-New libnl with older Linux headers is a valid combination. This is how
-hostapd build failure has been detected by Buildroot autobuilder, see:
-- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/
-
-Extend compile time condition for the enablement of the macsec hardware
-offload adding Linux headers version check.
-
-Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload")
-Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
-
-Upstream: https://w1.fi/cgit/hostap/commit/?id=809d9d8172db8e2a08ff639875f838b5b86d2641
-
----
- src/drivers/driver_macsec_linux.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
-index c86715498..fad47a292 100644
---- a/src/drivers/driver_macsec_linux.c
-+++ b/src/drivers/driver_macsec_linux.c
-@@ -19,6 +19,7 @@
- #include <netlink/route/link.h>
- #include <netlink/route/link/macsec.h>
- #include <linux/if_macsec.h>
-+#include <linux/version.h>
- #include <inttypes.h>
- 
- #include "utils/common.h"
-@@ -32,7 +33,8 @@
- 
- #define UNUSED_SCI 0xffffffffffffffff
- 
--#if LIBNL_VER_NUM >= LIBNL_VER(3, 6)
-+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \
-+     LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
- #define LIBNL_HAS_OFFLOAD
- #endif
- 
--- 
-2.46.0
-
diff --git a/package/wpa_supplicant/wpa_supplicant.hash b/package/wpa_supplicant/wpa_supplicant.hash
index 2f38dc257a..bea1e99b1f 100644
--- a/package/wpa_supplicant/wpa_supplicant.hash
+++ b/package/wpa_supplicant/wpa_supplicant.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a  wpa_supplicant-2.11.tar.gz
-sha256  f1b5992bbdd015c3ccb7faaadd62ef58ed821e15b9329bf2ceb27511ccc3f562  README
+sha256  08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6  wpa_supplicant-2.12.tar.gz
+sha256  83be1b142c59ccf0d6c5dde0695d8f84dfba109bea058e78ec2942389ccf327f  README
diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
index fe4bc34d55..93ac228947 100644
--- a/package/wpa_supplicant/wpa_supplicant.mk
+++ b/package/wpa_supplicant/wpa_supplicant.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-WPA_SUPPLICANT_VERSION = 2.11
+WPA_SUPPLICANT_VERSION = 2.12
 WPA_SUPPLICANT_SITE = http://w1.fi/releases
 WPA_SUPPLICANT_LICENSE = BSD-3-Clause
 WPA_SUPPLICANT_LICENSE_FILES = README
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

             reply	other threads:[~2026-08-16 10:20 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-16 10:20 Waldemar Brodkorb [this message]
2026-08-16 12:43 ` [Buildroot] [PATCH] package/wpa_supplicant: security bump to 2.12 Waldemar Brodkorb
2026-08-16 15:49   ` Julien Olivain via buildroot
2026-08-16 13:11 ` Julien Olivain via buildroot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aoGO11vvqxF6VTOy@waldemar-brodkorb.de \
    --to=wbx@openadk.org \
    --cc=buildroot@buildroot.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox