Re: Backporting CVE-2020-3702 ath9k patches to stable

On Thu, Sep 02, 2021 at 01:48:14PM +0200, Pavel Machek wrote:

Hi!

quoted

quoted

quoted

quoted

Hello! I would like to request for backporting following ath9k commits
which are fixing CVE-2020-3702 issue.

56c5485c9e44 ("ath: Use safer key clearing with key cache entries")
73488cb2fa3b ("ath9k: Clear key cache explicitly on disabling hardware")
d2d3e36498dd ("ath: Export ath_hw_keysetmac()")
144cd24dbc36 ("ath: Modify ath_key_delete() to not need full key entry")
ca2848022c12 ("ath9k: Postpone key cache entry deletion for TXQ frames reference it")

See also:
https://lore.kernel.org/linux-wireless/87o8hvlx5g.fsf@codeaurora.org/ (local)

...

quoted

quoted

quoted

What stable tree(s) do you want to see these go into?

Commits were introduced in 5.12, so it should go to all stable trees << 5.12

...

quoted

Great, all now queued up.  Sad that qcom didn't want to do this
themselves :(

Thanks for the fixes; I see them in 4.14 and newer stable trees.

But I don't see them in 4.4 and 4.9, nor can I see reason why they
were not applied.

Can someone help?

Odd, I don't remember why I didn't even try to apply them to older
kernels.  I'll do that after this next round is released in a few days,
sorry about that.

greg k-h