From e94f32a06069934ac9f74f52442c318e28aad385 Mon Sep 17 00:00:00 2001 From: Waldemar Brodkorb Date: Sun, 16 Aug 2026 12:20:07 +0200 Subject: [PATCH 1/2] package/wpa_supplicant: security bump to 2.12 See here for a Changelog: https://git.w1.fi/cgit/hostap/tree/wpa_supplicant/ChangeLog?id=e6386389448a4e0ec568fa7a27026e03f95bb768 Security issues fixed in this release: https://w1.fi/security/2026-4/incomplete-bounds-checking-of-mesh-ampe-messages-in-wpa_supplicant.txt https://w1.fi/security/2026-3/unexpected-sae-commit-message-contents-terminating-wpa_suppliant.txt https://w1.fi/security/2026-2/missing-network-context-validation-for-pmksa-caching.txt https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt Patches 0001 and 0002 are upstream. Tested on Raspberry PI4 (64 Bit). License changed: -Copyright (c) 2002-2024, Jouni Malinen and contributors +Copyright (c) 2002-2026, Jouni Malinen and contributors Signed-off-by: Waldemar Brodkorb Signed-off-by: Julien Olivain --- ...orization-completed-on-driver-indica.patch | 55 ------------------- ...dware-offload-requires-Linux-headers.patch | 53 ------------------ package/wpa_supplicant/wpa_supplicant.hash | 4 +- package/wpa_supplicant/wpa_supplicant.mk | 2 +- 4 files changed, 3 insertions(+), 111 deletions(-) delete mode 100644 package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch delete mode 100644 package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch diff --git a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch b/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch deleted file mode 100644 index 89954eb7c5f..00000000000 --- a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 170d8a433308ee39f87af94acaef461f8e80b67b Mon Sep 17 00:00:00 2001 -From: Janne Grunau -Date: Sun, 4 Aug 2024 13:24:42 +0200 -Subject: [PATCH] Revert "Mark authorization completed on driver indication during 4-way HS offload" - -This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5. - -Signed-off-by: Janne Grunau -Signed-off-by: Sergey Matyukevich - -Upstream: not yet sent, ongoing discussion http://lists.infradead.org/pipermail/hostap/2024-August/042893.html - ---- - wpa_supplicant/events.c | 25 ++++++++----------------- - 1 file changed, 8 insertions(+), 17 deletions(-) - -diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c -index 49917f7aa..bbb3a3eda 100644 ---- a/wpa_supplicant/events.c -+++ b/wpa_supplicant/events.c -@@ -4327,23 +4327,14 @@ static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s, - eapol_sm_notify_eap_success(wpa_s->eapol, true); - } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) && - wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) { -- if (already_authorized) { -- /* -- * We are done; the driver will take care of RSN 4-way -- * handshake. -- */ -- wpa_supplicant_cancel_auth_timeout(wpa_s); -- wpa_supplicant_set_state(wpa_s, WPA_COMPLETED); -- eapol_sm_notify_portValid(wpa_s->eapol, true); -- eapol_sm_notify_eap_success(wpa_s->eapol, true); -- } else { -- /* Update port, WPA_COMPLETED state from the -- * EVENT_PORT_AUTHORIZED handler when the driver is done -- * with the 4-way handshake. -- */ -- wpa_msg(wpa_s, MSG_DEBUG, -- "ASSOC INFO: wait for driver port authorized indication"); -- } -+ /* -+ * We are done; the driver will take care of RSN 4-way -+ * handshake. -+ */ -+ wpa_supplicant_cancel_auth_timeout(wpa_s); -+ wpa_supplicant_set_state(wpa_s, WPA_COMPLETED); -+ eapol_sm_notify_portValid(wpa_s->eapol, true); -+ eapol_sm_notify_eap_success(wpa_s->eapol, true); - } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) && - wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) { - /* --- -2.45.2 - diff --git a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch b/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch deleted file mode 100644 index 7330319d060..00000000000 --- a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001 -From: Sergey Matyukevich -Date: Thu, 22 Aug 2024 00:03:41 +0300 -Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7 - -Hardware offload in Linux macsec driver is enabled in compile time if -libnl version is >= v3.6. This is not sufficient for successful build -since enum 'macsec_offload' has been added to Linux header if_link.h -in kernels v5.6 and v5.7, see commits: -- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8 -- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf - -New libnl with older Linux headers is a valid combination. This is how -hostapd build failure has been detected by Buildroot autobuilder, see: -- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/ - -Extend compile time condition for the enablement of the macsec hardware -offload adding Linux headers version check. - -Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload") -Signed-off-by: Sergey Matyukevich - -Upstream: https://w1.fi/cgit/hostap/commit/?id=809d9d8172db8e2a08ff639875f838b5b86d2641 - ---- - src/drivers/driver_macsec_linux.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c -index c86715498..fad47a292 100644 ---- a/src/drivers/driver_macsec_linux.c -+++ b/src/drivers/driver_macsec_linux.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - #include - - #include "utils/common.h" -@@ -32,7 +33,8 @@ - - #define UNUSED_SCI 0xffffffffffffffff - --#if LIBNL_VER_NUM >= LIBNL_VER(3, 6) -+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \ -+ LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)) - #define LIBNL_HAS_OFFLOAD - #endif - --- -2.46.0 - diff --git a/package/wpa_supplicant/wpa_supplicant.hash b/package/wpa_supplicant/wpa_supplicant.hash index 2f38dc257aa..bea1e99b1f5 100644 --- a/package/wpa_supplicant/wpa_supplicant.hash +++ b/package/wpa_supplicant/wpa_supplicant.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a wpa_supplicant-2.11.tar.gz -sha256 f1b5992bbdd015c3ccb7faaadd62ef58ed821e15b9329bf2ceb27511ccc3f562 README +sha256 08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6 wpa_supplicant-2.12.tar.gz +sha256 83be1b142c59ccf0d6c5dde0695d8f84dfba109bea058e78ec2942389ccf327f README diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk index fe4bc34d550..93ac2289476 100644 --- a/package/wpa_supplicant/wpa_supplicant.mk +++ b/package/wpa_supplicant/wpa_supplicant.mk @@ -4,7 +4,7 @@ # ################################################################################ -WPA_SUPPLICANT_VERSION = 2.11 +WPA_SUPPLICANT_VERSION = 2.12 WPA_SUPPLICANT_SITE = http://w1.fi/releases WPA_SUPPLICANT_LICENSE = BSD-3-Clause WPA_SUPPLICANT_LICENSE_FILES = README From ac32b08ba298a78aa43dc90a4c8d1a181d9daf5e Mon Sep 17 00:00:00 2001 From: Alejandro Arrufat <15357691+AlexArrufat@users.noreply.github.com> Date: Sat, 31 Oct 2026 19:42:26 +0100 Subject: [PATCH 2/2] package/wpa_supplicant: retain legacy PSK offload compatibility Keep the existing 2.11 behavior on drivers that report association after firmware authentication without a separate port-authorized event. Rebase the compatibility patch onto 2.12 while leaving its new OWE offload path unchanged. --- ...rve-legacy-PSK-offload-authorization.patch | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 package/wpa_supplicant/0001-preserve-legacy-PSK-offload-authorization.patch diff --git a/package/wpa_supplicant/0001-preserve-legacy-PSK-offload-authorization.patch b/package/wpa_supplicant/0001-preserve-legacy-PSK-offload-authorization.patch new file mode 100644 index 00000000000..723505759ef --- /dev/null +++ b/package/wpa_supplicant/0001-preserve-legacy-PSK-offload-authorization.patch @@ -0,0 +1,43 @@ +From: Alejandro Arrufat <15357691+AlexArrufat@users.noreply.github.com> +Subject: [PATCH] wpa_supplicant: preserve legacy PSK offload authorization + +Rebase the existing Buildroot 2.11 compatibility revert onto 2.12. +The 2.12 update removes that revert, but upstream 2.12 still requires a +port-authorized event for PSK offload. Drivers such as brcmfmac need a +separate kernel fix before the revert can safely be removed. + +Keep the old PSK compatibility behavior only. The OWE offload branch was +combined with PSK in 2.12; retain its authorization-event handling. + +This preserves the behavior of the existing Buildroot 2.11 patch. +Kernel-side port-authorized reporting is the preferred long-term fix: +https://lore.kernel.org/r/20260912-brcmfmac-4way-handshake-offload-authenticated-event-v1-1-e41a6a8281a2@jannau.net + +Upstream: Not applicable [compatibility with kernels lacking PSK port authorization events] +Signed-off-by: Alejandro Arrufat <15357691+AlexArrufat@users.noreply.github.com> + +--- a/wpa_supplicant/events.c ++++ b/wpa_supplicant/events.c +@@ -4921,10 +4921,18 @@ + wpa_supplicant_set_state(wpa_s, WPA_COMPLETED); + eapol_sm_notify_portValid(wpa_s->eapol, true); + eapol_sm_notify_eap_success(wpa_s->eapol, true); +- } else if (((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) && +- wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) || +- ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_OWE_OFFLOAD_STA) && +- wpa_s->key_mgmt == WPA_KEY_MGMT_OWE)) { ++ } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) && ++ wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) { ++ /* Preserve compatibility with drivers that complete the firmware ++ * handshake before reporting association, but do not send a ++ * separate port-authorized event. ++ */ ++ wpa_supplicant_cancel_auth_timeout(wpa_s); ++ wpa_supplicant_set_state(wpa_s, WPA_COMPLETED); ++ eapol_sm_notify_portValid(wpa_s->eapol, true); ++ eapol_sm_notify_eap_success(wpa_s->eapol, true); ++ } else if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_OWE_OFFLOAD_STA) && ++ wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) { + if (already_authorized) { + /* + * We are done; the driver will take care of RSN 4-way