mac80211: backport upstream fixes for FragAttacks
[openwrt/openwrt.git] / package / kernel / mac80211 / patches / ath / 301-ath10k-drop-fragments-with-multicast-DA-for-PCIe.patch
1 From: Wen Gong <wgong@codeaurora.org>
2 Date: Tue, 11 May 2021 20:02:53 +0200
3 Subject: [PATCH] ath10k: drop fragments with multicast DA for PCIe
4
5 Fragmentation is not used with multicast frames. Discard unexpected
6 fragments with multicast DA. This fixes CVE-2020-26145.
7
8 Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
9
10 Cc: stable@vger.kernel.org
11 Signed-off-by: Wen Gong <wgong@codeaurora.org>
12 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
13 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
14 ---
15
16 --- a/drivers/net/wireless/ath/ath10k/htt_rx.c
17 +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
18 @@ -1768,6 +1768,16 @@ static u64 ath10k_htt_rx_h_get_pn(struct
19 return pn;
20 }
21
22 +static bool ath10k_htt_rx_h_frag_multicast_check(struct ath10k *ar,
23 + struct sk_buff *skb,
24 + u16 offset)
25 +{
26 + struct ieee80211_hdr *hdr;
27 +
28 + hdr = (struct ieee80211_hdr *)(skb->data + offset);
29 + return !is_multicast_ether_addr(hdr->addr1);
30 +}
31 +
32 static bool ath10k_htt_rx_h_frag_pn_check(struct ath10k *ar,
33 struct sk_buff *skb,
34 u16 peer_id,
35 @@ -1839,7 +1849,7 @@ static void ath10k_htt_rx_h_mpdu(struct
36 bool is_decrypted;
37 bool is_mgmt;
38 u32 attention;
39 - bool frag_pn_check = true;
40 + bool frag_pn_check = true, multicast_check = true;
41
42 if (skb_queue_empty(amsdu))
43 return;
44 @@ -1946,13 +1956,20 @@ static void ath10k_htt_rx_h_mpdu(struct
45 0,
46 enctype);
47
48 - if (!frag_pn_check) {
49 - /* Discard the fragment with invalid PN */
50 + if (frag)
51 + multicast_check = ath10k_htt_rx_h_frag_multicast_check(ar,
52 + msdu,
53 + 0);
54 +
55 + if (!frag_pn_check || !multicast_check) {
56 + /* Discard the fragment with invalid PN or multicast DA
57 + */
58 temp = msdu->prev;
59 __skb_unlink(msdu, amsdu);
60 dev_kfree_skb_any(msdu);
61 msdu = temp;
62 frag_pn_check = true;
63 + multicast_check = true;
64 continue;
65 }
66