leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ath10k: drop MPDU which has discard flag set by firmware for SDIO

Browse Source 
When the discard flag is set by the firmware for an MPDU, it should be
dropped. This allows a mitigation for CVE-2020-24588 to be implemented
in the firmware.

Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049

Cc: stable@vger.kernel.org
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20210511200110.11968c725b5c.Idd166365ebea2771c0c0a38c78b5060750f90e17@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Wen Gong 2021-05-11 20:02:55 +02:00 committed by Johannes Berg
parent 40e7462dad
commit 079a108feb
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/ath/ath10k/htt_rx.c
View File

@ -2312,6 +2312,11 @@ static bool ath10k_htt_rx_proc_rx_ind_hl(struct ath10k_htt *htt,
fw_desc = &rx->fw_desc;
rx_desc_len = fw_desc->len;
if (fw_desc->u.bits.discard) {
ath10k_dbg(ar, ATH10K_DBG_HTT, "htt discard mpdu\n");
goto err;
}
/* I have not yet seen any case where num_mpdu_ranges > 1.
* qcacld does not seem handle that case either, so we introduce the
* same limitiation here as well.

14
drivers/net/wireless/ath/ath10k/rx_desc.h
View File

@ -1282,7 +1282,19 @@ struct fw_rx_desc_base {
#define FW_RX_DESC_UDP (1 << 6)
struct fw_rx_desc_hl {
u8 info0;
union {
struct {
u8 discard:1,
forward:1,
any_err:1,
dup_err:1,
reserved:1,
inspect:1,
extension:2;
} bits;
u8 info0;
} u;
u8 version;
u8 len;
u8 flags;