Commit 079a108f authored by Wen Gong's avatar Wen Gong Committed by Johannes Berg
Browse files

ath10k: drop MPDU which has discard flag set by firmware for SDIO 



When the discard flag is set by the firmware for an MPDU, it should be
dropped. This allows a mitigation for CVE-2020-24588 to be implemented
in the firmware.

Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049

Cc: stable@vger.kernel.org
Signed-off-by: default avatarWen Gong <wgong@codeaurora.org>
Signed-off-by: default avatarJouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20210511200110.11968c725b5c.Idd166365ebea2771c0c0a38c78b5060750f90e17@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 40e7462d

drivers/net/wireless/ath/ath10k/htt_rx.c

+5 −0
Original line number Diff line number Diff line
@@ -2312,6 +2312,11 @@ static bool ath10k_htt_rx_proc_rx_ind_hl(struct ath10k_htt *htt, 
	fw_desc = &rx->fw_desc;

	rx_desc_len = fw_desc->len;



	if (fw_desc->u.bits.discard) {

		ath10k_dbg(ar, ATH10K_DBG_HTT, "htt discard mpdu\n");

		goto err;

	}



	/* I have not yet seen any case where num_mpdu_ranges > 1.

	 * qcacld does not seem handle that case either, so we introduce the

	 * same limitiation here as well.

drivers/net/wireless/ath/ath10k/rx_desc.h

+13 −1
Original line number Diff line number Diff line
@@ -1282,7 +1282,19 @@ struct fw_rx_desc_base { 
#define FW_RX_DESC_UDP              (1 << 6)



struct fw_rx_desc_hl {

	union {

		struct {

		u8 discard:1,

		   forward:1,

		   any_err:1,

		   dup_err:1,

		   reserved:1,

		   inspect:1,

		   extension:2;

		} bits;

		u8 info0;

	} u;



	u8 version;

	u8 len;

	u8 flags;