[PATCH] brcmfmac-cyw: clean up PMKID and cookie code

[PATCH] brcmfmac-cyw: clean up PMKID and cookie code

[Bogdan Nicolae]

Avoid setting packet_id to cookie, which is always 0. Instead, use an
increasing atomic counter. Avoids mismatches of completion events later
in brcmf_notify_mgmt_tx_status, where packet_id != vif->mgmt_tx_id is
checked.

Also, zero out auth_status on initialization. Otherwise, garbage will
leak from the stack to the firmware (when bssid is less than 32 bytes
and/or when params->pmkid is set). Then, pass the params->pmkid to the
firmware (without it, the firmware caches a garbage PMKID on successful
authentication and denies a subsequent association request that includes
the PMKID).

Signed-off-by: Bogdan Nicolae <bogdan.nicolae@acm.org>
---
.../net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c  | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
index ce09d44fa..06e5dc79c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
@@ -2,6 +2,7 @@
/*
 * Copyright (c) 2022 Broadcom Corporation
 */
+#include <linux/atomic.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <core.h>
@@ -23,6 +24,8 @@
#define MGMT_AUTH_FRAME_DWELL_TIME     4000
#define MGMT_AUTH_FRAME_WAIT_TIME      (MGMT_AUTH_FRAME_DWELL_TIME + 100)

+static atomic_t brcmf_cyw_mgmt_tx_id = ATOMIC_INIT(0);
+
static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp,
                                struct cfg80211_crypto_settings *crypto)
{
@@ -155,7 +158,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct
wireless_dev *wdev,

       memcpy(&mf_params->da[0], &mgmt->da[0], ETH_ALEN);
       memcpy(&mf_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
-       mf_params->packet_id = cpu_to_le32(*cookie);
+       mf_params->packet_id =
cpu_to_le32(atomic_inc_return(&brcmf_cyw_mgmt_tx_id));
       memcpy(mf_params->data, &buf[DOT11_MGMT_HDR_LEN],
              le16_to_cpu(mf_params->len));

@@ -200,7 +203,7 @@ brcmf_cyw_external_auth(struct wiphy *wiphy,
struct net_device *dev,
{
       struct brcmf_if *ifp;
       struct brcmf_pub *drvr;
-       struct brcmf_auth_req_status_le auth_status;
+       struct brcmf_auth_req_status_le auth_status = {};
       int ret = 0;

       brcmf_dbg(TRACE, "Enter\n");
@@ -208,6 +211,8 @@ brcmf_cyw_external_auth(struct wiphy *wiphy,
struct net_device *dev,
       ifp = netdev_priv(dev);
       drvr = ifp->drvr;
       if (params->status == WLAN_STATUS_SUCCESS) {
+               if (params->pmkid)
+                       memcpy(auth_status.pmkid, params->pmkid,
WLAN_PMKID_LEN);
               auth_status.flags = cpu_to_le16(BRCMF_EXTAUTH_SUCCESS);
       } else {
               bphy_err(drvr, "External authentication failed: status=%d\n",
--
2.54.0

Re: [PATCH] brcmfmac-cyw: clean up PMKID and cookie code

[Arend van Spriel]

On Fri, 3 Jul 2026 17:39:51 -0500, Bogdan Nicolae wrote:
> Avoid setting packet_id to cookie, which is always 0. Instead, use an
> increasing atomic counter. Avoids mismatches of completion events later
> in brcmf_notify_mgmt_tx_status, where packet_id != vif->mgmt_tx_id is
> checked.
>
> Also, zero out auth_status on initialization. Otherwise, garbage will
> leak from the stack to the firmware (when bssid is less than 32 bytes
> and/or when params->pmkid is set). Then, pass the params->pmkid to the
> firmware (without it, the firmware caches a garbage PMKID on successful
> authentication and denies a subsequent association request that includes
> the PMKID).
>
> Signed-off-by: Bogdan Nicolae <bogdan.nicolae@acm.org>

The patch failed to apply because it had line-wrapped diff lines. Please
resend. git format-patch and git send-email are your friend (well, can be).

Also, the subject line is missing the "wifi:" prefix. It should read:

  wifi: brcmfmac: cyw: clean up PMKID and cookie code

Regards,
Arend