From bbb687e3b506b19a7e43cf2be16f643c6c5bfaa9 Mon Sep 17 00:00:00 2001 From: Bogdan Nicolae Date: Wed, 24 Jun 2026 23:55:34 -0500 Subject: [PATCH 1/2] PMKID needs to be passed to firmware if present --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c index 4f0ea4347840b5..87faac6c68ca25 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c @@ -221,6 +221,9 @@ brcmf_cyw_external_auth(struct wiphy *wiphy, struct net_device *dev, IEEE80211_MAX_SSID_LEN); auth_status.ssid_len = cpu_to_le32(params->ssid.ssid_len); memcpy(auth_status.ssid, params->ssid.ssid, params->ssid.ssid_len); + memset(auth_status.pmkid, 0, WLAN_PMKID_LEN); + if (params->pmkid) + memcpy(auth_status.pmkid, params->pmkid, WLAN_PMKID_LEN); ret = brcmf_fil_iovar_data_set(ifp, "auth_status", &auth_status, sizeof(auth_status)); From e3df536c03657ebe414eda9d162c94cf8b2fdcd5 Mon Sep 17 00:00:00 2001 From: Bogdan Nicolae Date: Wed, 24 Jun 2026 23:55:34 -0500 Subject: [PATCH 2/2] brcmfmac: pass PMKID to firmware if present External authentication during WPA3 SAE exchange ignores the PMKID and passes garbage (whatever is on the stack) downstream. This causes latent bugs (bogus entries in the firmware's lookup tables) that lead to connectivity issues. For example, in AP mode, a client that includes a PMKID in association frames will be rejected. The fix sets the PMKID either to zeros or the correct value if present, ensuring no bogus entries are used downstream. Signed-off-by: Bogdan Nicolae (bogdan.nicolae@acm.org) --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c index 4f0ea4347840b5..87faac6c68ca25 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c @@ -221,6 +221,9 @@ brcmf_cyw_external_auth(struct wiphy *wiphy, struct net_device *dev, IEEE80211_MAX_SSID_LEN); auth_status.ssid_len = cpu_to_le32(params->ssid.ssid_len); memcpy(auth_status.ssid, params->ssid.ssid, params->ssid.ssid_len); + memset(auth_status.pmkid, 0, WLAN_PMKID_LEN); + if (params->pmkid) + memcpy(auth_status.pmkid, params->pmkid, WLAN_PMKID_LEN); ret = brcmf_fil_iovar_data_set(ifp, "auth_status", &auth_status, sizeof(auth_status));