lkml.org 
[lkml]   [2021]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 027/177] ath10k: drop MPDU which has discard flag set by firmware for SDIO
    Date
    From: Wen Gong <wgong@codeaurora.org>

    commit 079a108feba474b4b32bd3471db03e11f2f83b81 upstream.

    When the discard flag is set by the firmware for an MPDU, it should be
    dropped. This allows a mitigation for CVE-2020-24588 to be implemented
    in the firmware.

    Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049

    Cc: stable@vger.kernel.org
    Signed-off-by: Wen Gong <wgong@codeaurora.org>
    Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
    Link: https://lore.kernel.org/r/20210511200110.11968c725b5c.Idd166365ebea2771c0c0a38c78b5060750f90e17@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/wireless/ath/ath10k/htt_rx.c | 5 +++++
    drivers/net/wireless/ath/ath10k/rx_desc.h | 14 +++++++++++++-
    2 files changed, 18 insertions(+), 1 deletion(-)

    --- a/drivers/net/wireless/ath/ath10k/htt_rx.c
    +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
    @@ -2305,6 +2305,11 @@ static bool ath10k_htt_rx_proc_rx_ind_hl
    fw_desc = &rx->fw_desc;
    rx_desc_len = fw_desc->len;

    + if (fw_desc->u.bits.discard) {
    + ath10k_dbg(ar, ATH10K_DBG_HTT, "htt discard mpdu\n");
    + goto err;
    + }
    +
    /* I have not yet seen any case where num_mpdu_ranges > 1.
    * qcacld does not seem handle that case either, so we introduce the
    * same limitiation here as well.
    --- a/drivers/net/wireless/ath/ath10k/rx_desc.h
    +++ b/drivers/net/wireless/ath/ath10k/rx_desc.h
    @@ -1282,7 +1282,19 @@ struct fw_rx_desc_base {
    #define FW_RX_DESC_UDP (1 << 6)

    struct fw_rx_desc_hl {
    - u8 info0;
    + union {
    + struct {
    + u8 discard:1,
    + forward:1,
    + any_err:1,
    + dup_err:1,
    + reserved:1,
    + inspect:1,
    + extension:2;
    + } bits;
    + u8 info0;
    + } u;
    +
    u8 version;
    u8 len;
    u8 flags;

    \
     
     \ /
      Last update: 2021-05-31 17:16    [W:4.144 / U:0.244 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site