mac80211, mt76: add fixes for recently discovered security issues
[openwrt/openwrt.git] / package / kernel / mt76 / patches / 101-fix-encap-offload-ethernet-type-check.patch
1 From: Felix Fietkau <nbd@nbd.name>
2 To: linux-wireless@vger.kernel.org
3 Cc: =?utf-8?q?Thibaut_VAR=C3=88NE?= <hacks+kernel@slashdirt.org>
4 Subject: [PATCH] mt76: fix encap offload ethernet type check
5 Date: Wed, 20 Apr 2022 14:33:08 +0200
6 Message-Id: <20220420123308.70104-1-nbd@nbd.name>
7
8 The driver needs to check if the format is 802.2 vs 802.3 in order to set
9 a tx descriptor flag. skb->protocol can't be used, since it may not be properly
10 initialized for packets coming in from a packet socket.
11 Fix misdetection by checking the ethertype from the skb data instead
12
13 Reported-by: Thibaut VARĂˆNE <hacks+kernel@slashdirt.org>
14 Signed-off-by: Felix Fietkau <nbd@nbd.name>
15 ---
16 drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +++-
17 drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 4 +++-
18 2 files changed, 6 insertions(+), 2 deletions(-)
19
20 --- a/mt7915/mac.c
21 +++ b/mt7915/mac.c
22 @@ -977,6 +977,7 @@ mt7915_mac_write_txwi_8023(struct mt7915
23
24 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
25 u8 fc_type, fc_stype;
26 + u16 ethertype;
27 bool wmm = false;
28 u32 val;
29
30 @@ -990,7 +991,8 @@ mt7915_mac_write_txwi_8023(struct mt7915
31 val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_802_3) |
32 FIELD_PREP(MT_TXD1_TID, tid);
33
34 - if (be16_to_cpu(skb->protocol) >= ETH_P_802_3_MIN)
35 + ethertype = get_unaligned_be16(&skb->data[12]);
36 + if (ethertype >= ETH_P_802_3_MIN)
37 val |= MT_TXD1_ETH_802_3;
38
39 txwi[1] |= cpu_to_le32(val);
40 --- a/mt7921/mac.c
41 +++ b/mt7921/mac.c
42 @@ -811,6 +811,7 @@ mt7921_mac_write_txwi_8023(struct mt7921
43 {
44 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
45 u8 fc_type, fc_stype;
46 + u16 ethertype;
47 bool wmm = false;
48 u32 val;
49
50 @@ -824,7 +825,8 @@ mt7921_mac_write_txwi_8023(struct mt7921
51 val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_802_3) |
52 FIELD_PREP(MT_TXD1_TID, tid);
53
54 - if (be16_to_cpu(skb->protocol) >= ETH_P_802_3_MIN)
55 + ethertype = get_unaligned_be16(&skb->data[12]);
56 + if (ethertype >= ETH_P_802_3_MIN)
57 val |= MT_TXD1_ETH_802_3;
58
59 txwi[1] |= cpu_to_le32(val);