diff options
| author |   Baochen Qiang <bqiang@codeaurora.org> | 2021-09-28 14:00:43 +0300 |
|---|---|---|
| committer |   Kalle Valo <kvalo@codeaurora.org> | 2021-09-28 16:33:40 +0300 |
| commit | cd18ed4cf8051ceb8590263f5914cb9bb58b0f25 (patch) | |
| tree | 951c42c638add2479e1e8a0e393dfe86dfcdd939 /drivers/net/wireless/ath/ath11k/dp_rx.c | |
| parent | ath11k: copy cap info of 6G band under WMI_HOST_WLAN_5G_CAP for WCN6855 (diff) | |
| download | linux-dev-cd18ed4cf8051ceb8590263f5914cb9bb58b0f25.tar.xz linux-dev-cd18ed4cf8051ceb8590263f5914cb9bb58b0f25.zip | |
ath11k: Drop MSDU with length error in DP rx path
There are MSDUs whose length are invalid. For example,
attackers may inject on purpose truncated A-MSDUs with
invalid MSDU length.
Such MSDUs are marked with an err bit set in rx attention
tlvs, so we can check and drop them.
Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210913180246.193388-2-jouni@codeaurora.org
Diffstat (limited to 'drivers/net/wireless/ath/ath11k/dp_rx.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath11k/dp_rx.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index f08eb9e6c820..b145ea5b1d54 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -142,6 +142,18 @@ static u32 ath11k_dp_rx_h_attn_mpdu_err(struct rx_attention *attn) return errmap; } +static bool ath11k_dp_rx_h_attn_msdu_len_err(struct ath11k_base *ab, + struct hal_rx_desc *desc) +{ + struct rx_attention *rx_attention; + u32 errmap; + + rx_attention = ath11k_dp_rx_get_attention(ab, desc); + errmap = ath11k_dp_rx_h_attn_mpdu_err(rx_attention); + + return errmap & DP_RX_MPDU_ERR_MSDU_LEN; +} + static u16 ath11k_dp_rx_h_msdu_start_msdu_len(struct ath11k_base *ab, struct hal_rx_desc *desc) { @@ -2525,6 +2537,12 @@ static int ath11k_dp_rx_process_msdu(struct ath11k *ar, } rx_desc = (struct hal_rx_desc *)msdu->data; + if (ath11k_dp_rx_h_attn_msdu_len_err(ab, rx_desc)) { + ath11k_warn(ar->ab, "msdu len not valid\n"); + ret = -EIO; + goto free_out; + } + lrx_desc = (struct hal_rx_desc *)last_buf->data; rx_attention = ath11k_dp_rx_get_attention(ab, lrx_desc); if (!ath11k_dp_rx_h_attn_msdu_done(rx_attention)) { |