Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Waldemar Brodkorb <wbx@openadk.org>
To: buildroot@buildroot.org
Cc: Sergey Matyukevich <geomatsi@gmail.com>
Subject: Re: [Buildroot] [PATCH] package/wpa_supplicant: security bump to 2.12
Date: Sun, 16 Aug 2026 14:43:30 +0200	[thread overview]
Message-ID: <aoGwcjcKAP0U4OnW@waldemar-brodkorb.de> (raw)
In-Reply-To: <aoGO11vvqxF6VTOy@waldemar-brodkorb.de>

Hi,

forgot to add Maintainer to CC.

Waldemar Brodkorb wrote,

> See here for a Changelog:
> https://git.w1.fi/cgit/hostap/tree/wpa_supplicant/ChangeLog?id=e6386389448a4e0ec568fa7a27026e03f95bb768
> 
> Security issues fixed in this release:
> https://w1.fi/security/2026-4/incomplete-bounds-checking-of-mesh-ampe-messages-in-wpa_supplicant.txt
> https://w1.fi/security/2026-3/unexpected-sae-commit-message-contents-terminating-wpa_suppliant.txt
> https://w1.fi/security/2026-2/missing-network-context-validation-for-pmksa-caching.txt
> https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
> 
> Patches 0001 and 0002 are upstream.
> 
> Tested on Raspberry PI4 (64 Bit).
> 
> License changed:
> -Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi> and contributors
> +Copyright (c) 2002-2026, Jouni Malinen <j@w1.fi> and contributors
> 
> Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
> ---
>  ...orization-completed-on-driver-indica.patch | 55 -------------------
>  ...dware-offload-requires-Linux-headers.patch | 53 ------------------
>  package/wpa_supplicant/wpa_supplicant.hash    |  4 +-
>  package/wpa_supplicant/wpa_supplicant.mk      |  2 +-
>  4 files changed, 3 insertions(+), 111 deletions(-)
>  delete mode 100644 package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
>  delete mode 100644 package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> 
> diff --git a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch b/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
> deleted file mode 100644
> index 89954eb7c5..0000000000
> --- a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
> +++ /dev/null
> @@ -1,55 +0,0 @@
> -From 170d8a433308ee39f87af94acaef461f8e80b67b Mon Sep 17 00:00:00 2001
> -From: Janne Grunau <janne-fdr@jannau.net>
> -Date: Sun, 4 Aug 2024 13:24:42 +0200
> -Subject: [PATCH] Revert "Mark authorization completed on driver indication during 4-way HS offload"
> -
> -This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.
> -
> -Signed-off-by: Janne Grunau <janne-fdr@jannau.net>
> -Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> -
> -Upstream: not yet sent, ongoing discussion http://lists.infradead.org/pipermail/hostap/2024-August/042893.html
> -
> ----
> - wpa_supplicant/events.c | 25 ++++++++-----------------
> - 1 file changed, 8 insertions(+), 17 deletions(-)
> -
> -diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
> -index 49917f7aa..bbb3a3eda 100644
> ---- a/wpa_supplicant/events.c
> -+++ b/wpa_supplicant/events.c
> -@@ -4327,23 +4327,14 @@ static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
> - 		eapol_sm_notify_eap_success(wpa_s->eapol, true);
> - 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) &&
> - 		   wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
> --		if (already_authorized) {
> --			/*
> --			 * We are done; the driver will take care of RSN 4-way
> --			 * handshake.
> --			 */
> --			wpa_supplicant_cancel_auth_timeout(wpa_s);
> --			wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
> --			eapol_sm_notify_portValid(wpa_s->eapol, true);
> --			eapol_sm_notify_eap_success(wpa_s->eapol, true);
> --		} else {
> --			/* Update port, WPA_COMPLETED state from the
> --			 * EVENT_PORT_AUTHORIZED handler when the driver is done
> --			 * with the 4-way handshake.
> --			 */
> --			wpa_msg(wpa_s, MSG_DEBUG,
> --				"ASSOC INFO: wait for driver port authorized indication");
> --		}
> -+		/*
> -+		 * We are done; the driver will take care of RSN 4-way
> -+		 * handshake.
> -+		 */
> -+		wpa_supplicant_cancel_auth_timeout(wpa_s);
> -+		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
> -+		eapol_sm_notify_portValid(wpa_s->eapol, true);
> -+		eapol_sm_notify_eap_success(wpa_s->eapol, true);
> - 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
> - 		   wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
> - 		/*
> --- 
> -2.45.2
> -
> diff --git a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch b/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> deleted file mode 100644
> index 7330319d06..0000000000
> --- a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> +++ /dev/null
> @@ -1,53 +0,0 @@
> -From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001
> -From: Sergey Matyukevich <geomatsi@gmail.com>
> -Date: Thu, 22 Aug 2024 00:03:41 +0300
> -Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7
> -
> -Hardware offload in Linux macsec driver is enabled in compile time if
> -libnl version is >= v3.6. This is not sufficient for successful build
> -since enum 'macsec_offload' has been added to Linux header if_link.h
> -in kernels v5.6 and v5.7, see commits:
> -- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8
> -- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf
> -
> -New libnl with older Linux headers is a valid combination. This is how
> -hostapd build failure has been detected by Buildroot autobuilder, see:
> -- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/
> -
> -Extend compile time condition for the enablement of the macsec hardware
> -offload adding Linux headers version check.
> -
> -Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload")
> -Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> -
> -Upstream: https://w1.fi/cgit/hostap/commit/?id=809d9d8172db8e2a08ff639875f838b5b86d2641
> -
> ----
> - src/drivers/driver_macsec_linux.c | 4 +++-
> - 1 file changed, 3 insertions(+), 1 deletion(-)
> -
> -diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
> -index c86715498..fad47a292 100644
> ---- a/src/drivers/driver_macsec_linux.c
> -+++ b/src/drivers/driver_macsec_linux.c
> -@@ -19,6 +19,7 @@
> - #include <netlink/route/link.h>
> - #include <netlink/route/link/macsec.h>
> - #include <linux/if_macsec.h>
> -+#include <linux/version.h>
> - #include <inttypes.h>
> - 
> - #include "utils/common.h"
> -@@ -32,7 +33,8 @@
> - 
> - #define UNUSED_SCI 0xffffffffffffffff
> - 
> --#if LIBNL_VER_NUM >= LIBNL_VER(3, 6)
> -+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \
> -+     LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
> - #define LIBNL_HAS_OFFLOAD
> - #endif
> - 
> --- 
> -2.46.0
> -
> diff --git a/package/wpa_supplicant/wpa_supplicant.hash b/package/wpa_supplicant/wpa_supplicant.hash
> index 2f38dc257a..bea1e99b1f 100644
> --- a/package/wpa_supplicant/wpa_supplicant.hash
> +++ b/package/wpa_supplicant/wpa_supplicant.hash
> @@ -1,3 +1,3 @@
>  # Locally calculated
> -sha256  912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a  wpa_supplicant-2.11.tar.gz
> -sha256  f1b5992bbdd015c3ccb7faaadd62ef58ed821e15b9329bf2ceb27511ccc3f562  README
> +sha256  08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6  wpa_supplicant-2.12.tar.gz
> +sha256  83be1b142c59ccf0d6c5dde0695d8f84dfba109bea058e78ec2942389ccf327f  README
> diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
> index fe4bc34d55..93ac228947 100644
> --- a/package/wpa_supplicant/wpa_supplicant.mk
> +++ b/package/wpa_supplicant/wpa_supplicant.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -WPA_SUPPLICANT_VERSION = 2.11
> +WPA_SUPPLICANT_VERSION = 2.12
>  WPA_SUPPLICANT_SITE = http://w1.fi/releases
>  WPA_SUPPLICANT_LICENSE = BSD-3-Clause
>  WPA_SUPPLICANT_LICENSE_FILES = README
> -- 
> 2.47.3
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
> 
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

  reply	other threads:[~2026-08-16 12:43 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-16 10:20 [Buildroot] [PATCH] package/wpa_supplicant: security bump to 2.12 Waldemar Brodkorb
2026-08-16 12:43 ` Waldemar Brodkorb [this message]
2026-08-16 15:49   ` Julien Olivain via buildroot
2026-08-16 13:11 ` Julien Olivain via buildroot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aoGwcjcKAP0U4OnW@waldemar-brodkorb.de \
    --to=wbx@openadk.org \
    --cc=buildroot@buildroot.org \
    --cc=geomatsi@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox