package/kernel/mac80211/patches/ath/301-ath10k-drop-fragments-with-multicast-DA-for-PCIe.patch

   1 From: Wen Gong <wgong@codeaurora.org>
   2 Date: Tue, 11 May 2021 20:02:53 +0200
   3 Subject: [PATCH] ath10k: drop fragments with multicast DA for PCIe
   4
   5 Fragmentation is not used with multicast frames. Discard unexpected
   6 fragments with multicast DA. This fixes CVE-2020-26145.
   7
   8 Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
   9
  10 Cc: stable@vger.kernel.org
  11 Signed-off-by: Wen Gong <wgong@codeaurora.org>
  12 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
  13 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  14 ---
  15
  16 --- a/drivers/net/wireless/ath/ath10k/htt_rx.c
  17 +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
  18 @@ -1768,6 +1768,16 @@ static u64 ath10k_htt_rx_h_get_pn(struct
  19         return pn;
  20  }
  21
  22 +static bool ath10k_htt_rx_h_frag_multicast_check(struct ath10k *ar,
  23 +                                                struct sk_buff *skb,
  24 +                                                u16 offset)
  25 +{
  26 +       struct ieee80211_hdr *hdr;
  27 +
  28 +       hdr = (struct ieee80211_hdr *)(skb->data + offset);
  29 +       return !is_multicast_ether_addr(hdr->addr1);
  30 +}
  31 +
  32  static bool ath10k_htt_rx_h_frag_pn_check(struct ath10k *ar,
  33                                           struct sk_buff *skb,
  34                                           u16 peer_id,
  35 @@ -1839,7 +1849,7 @@ static void ath10k_htt_rx_h_mpdu(struct
  36         bool is_decrypted;
  37         bool is_mgmt;
  38         u32 attention;
  39 -       bool frag_pn_check = true;
  40 +       bool frag_pn_check = true, multicast_check = true;
  41
  42         if (skb_queue_empty(amsdu))
  43                 return;
  44 @@ -1946,13 +1956,20 @@ static void ath10k_htt_rx_h_mpdu(struct
  45                                                                       0,
  46                                                                       enctype);
  47
  48 -               if (!frag_pn_check) {
  49 -                       /* Discard the fragment with invalid PN */
  50 +               if (frag)
  51 +                       multicast_check = ath10k_htt_rx_h_frag_multicast_check(ar,
  52 +                                                                              msdu,
  53 +                                                                              0);
  54 +
  55 +               if (!frag_pn_check || !multicast_check) {
  56 +                       /* Discard the fragment with invalid PN or multicast DA
  57 +                        */
  58                         temp = msdu->prev;
  59                         __skb_unlink(msdu, amsdu);
  60                         dev_kfree_skb_any(msdu);
  61                         msdu = temp;
  62                         frag_pn_check = true;
  63 +                       multicast_check = true;
  64                         continue;
  65                 }
  66