Re: [Buildroot] [PATCH] package/wpa_supplicant: security bump to 2.12

Hi,

forgot to add Maintainer to CC.

Waldemar Brodkorb wrote,

> See here for a Changelog:
> https://git.w1.fi/cgit/hostap/tree/wpa_supplicant/ChangeLog?id=e6386389448a4e0ec568fa7a27026e03f95bb768
> 
> Security issues fixed in this release:
> https://w1.fi/security/2026-4/incomplete-bounds-checking-of-mesh-ampe-messages-in-wpa_supplicant.txt
> https://w1.fi/security/2026-3/unexpected-sae-commit-message-contents-terminating-wpa_suppliant.txt
> https://w1.fi/security/2026-2/missing-network-context-validation-for-pmksa-caching.txt
> https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
> 
> Patches 0001 and 0002 are upstream.
> 
> Tested on Raspberry PI4 (64 Bit).
> 
> License changed:
> -Copyright (c) 2002-2024, Jouni Malinen <[email protected]> and contributors
> +Copyright (c) 2002-2026, Jouni Malinen <[email protected]> and contributors
> 
> Signed-off-by: Waldemar Brodkorb <[email protected]>
> ---
>  ...orization-completed-on-driver-indica.patch | 55 -------------------
>  ...dware-offload-requires-Linux-headers.patch | 53 ------------------
>  package/wpa_supplicant/wpa_supplicant.hash    |  4 +-
>  package/wpa_supplicant/wpa_supplicant.mk      |  2 +-
>  4 files changed, 3 insertions(+), 111 deletions(-)
>  delete mode 100644 package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
>  delete mode 100644 package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> 
> diff --git a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch b/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
> deleted file mode 100644
> index 89954eb7c5..0000000000
> --- a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
> +++ /dev/null
> @@ -1,55 +0,0 @@
> -From 170d8a433308ee39f87af94acaef461f8e80b67b Mon Sep 17 00:00:00 2001
> -From: Janne Grunau <[email protected]>
> -Date: Sun, 4 Aug 2024 13:24:42 +0200
> -Subject: [PATCH] Revert "Mark authorization completed on driver indication during 4-way HS offload"
> -
> -This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.
> -
> -Signed-off-by: Janne Grunau <[email protected]>
> -Signed-off-by: Sergey Matyukevich <[email protected]>
> -
> -Upstream: not yet sent, ongoing discussion http://lists.infradead.org/pipermail/hostap/2024-August/042893.html
> -
> ----
> - wpa_supplicant/events.c | 25 ++++++++-----------------
> - 1 file changed, 8 insertions(+), 17 deletions(-)
> -
> -diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
> -index 49917f7aa..bbb3a3eda 100644
> ---- a/wpa_supplicant/events.c
> -+++ b/wpa_supplicant/events.c
> -@@ -4327,23 +4327,14 @@ static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
> - 		eapol_sm_notify_eap_success(wpa_s->eapol, true);
> - 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) &&
> - 		   wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
> --		if (already_authorized) {
> --			/*
> --			 * We are done; the driver will take care of RSN 4-way
> --			 * handshake.
> --			 */
> --			wpa_supplicant_cancel_auth_timeout(wpa_s);
> --			wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
> --			eapol_sm_notify_portValid(wpa_s->eapol, true);
> --			eapol_sm_notify_eap_success(wpa_s->eapol, true);
> --		} else {
> --			/* Update port, WPA_COMPLETED state from the
> --			 * EVENT_PORT_AUTHORIZED handler when the driver is done
> --			 * with the 4-way handshake.
> --			 */
> --			wpa_msg(wpa_s, MSG_DEBUG,
> --				"ASSOC INFO: wait for driver port authorized indication");
> --		}
> -+		/*
> -+		 * We are done; the driver will take care of RSN 4-way
> -+		 * handshake.
> -+		 */
> -+		wpa_supplicant_cancel_auth_timeout(wpa_s);
> -+		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
> -+		eapol_sm_notify_portValid(wpa_s->eapol, true);
> -+		eapol_sm_notify_eap_success(wpa_s->eapol, true);
> - 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
> - 		   wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
> - 		/*
> --- 
> -2.45.2
> -
> diff --git a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch b/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> deleted file mode 100644
> index 7330319d06..0000000000
> --- a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
> +++ /dev/null
> @@ -1,53 +0,0 @@
> -From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001
> -From: Sergey Matyukevich <[email protected]>
> -Date: Thu, 22 Aug 2024 00:03:41 +0300
> -Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7
> -
> -Hardware offload in Linux macsec driver is enabled in compile time if
> -libnl version is >= v3.6. This is not sufficient for successful build
> -since enum 'macsec_offload' has been added to Linux header if_link.h
> -in kernels v5.6 and v5.7, see commits:
> -- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8
> -- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf
> -
> -New libnl with older Linux headers is a valid combination. This is how
> -hostapd build failure has been detected by Buildroot autobuilder, see:
> -- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/
> -
> -Extend compile time condition for the enablement of the macsec hardware
> -offload adding Linux headers version check.
> -
> -Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload")
> -Signed-off-by: Sergey Matyukevich <[email protected]>
> -
> -Upstream: https://w1.fi/cgit/hostap/commit/?id=809d9d8172db8e2a08ff639875f838b5b86d2641
> -
> ----
> - src/drivers/driver_macsec_linux.c | 4 +++-
> - 1 file changed, 3 insertions(+), 1 deletion(-)
> -
> -diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
> -index c86715498..fad47a292 100644
> ---- a/src/drivers/driver_macsec_linux.c
> -+++ b/src/drivers/driver_macsec_linux.c
> -@@ -19,6 +19,7 @@
> - #include <netlink/route/link.h>
> - #include <netlink/route/link/macsec.h>
> - #include <linux/if_macsec.h>
> -+#include <linux/version.h>
> - #include <inttypes.h>
> - 
> - #include "utils/common.h"
> -@@ -32,7 +33,8 @@
> - 
> - #define UNUSED_SCI 0xffffffffffffffff
> - 
> --#if LIBNL_VER_NUM >= LIBNL_VER(3, 6)
> -+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \
> -+     LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
> - #define LIBNL_HAS_OFFLOAD
> - #endif
> - 
> --- 
> -2.46.0
> -
> diff --git a/package/wpa_supplicant/wpa_supplicant.hash b/package/wpa_supplicant/wpa_supplicant.hash
> index 2f38dc257a..bea1e99b1f 100644
> --- a/package/wpa_supplicant/wpa_supplicant.hash
> +++ b/package/wpa_supplicant/wpa_supplicant.hash
> @@ -1,3 +1,3 @@
>  # Locally calculated
> -sha256  912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a  wpa_supplicant-2.11.tar.gz
> -sha256  f1b5992bbdd015c3ccb7faaadd62ef58ed821e15b9329bf2ceb27511ccc3f562  README
> +sha256  08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6  wpa_supplicant-2.12.tar.gz
> +sha256  83be1b142c59ccf0d6c5dde0695d8f84dfba109bea058e78ec2942389ccf327f  README
> diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
> index fe4bc34d55..93ac228947 100644
> --- a/package/wpa_supplicant/wpa_supplicant.mk
> +++ b/package/wpa_supplicant/wpa_supplicant.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -WPA_SUPPLICANT_VERSION = 2.11
> +WPA_SUPPLICANT_VERSION = 2.12
>  WPA_SUPPLICANT_SITE = http://w1.fi/releases
>  WPA_SUPPLICANT_LICENSE = BSD-3-Clause
>  WPA_SUPPLICANT_LICENSE_FILES = README
> -- 
> 2.47.3
> 
> _______________________________________________
> buildroot mailing list
> [email protected]
> https://lists.buildroot.org/mailman/listinfo/buildroot
> 
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot