lkml.org 
[lkml]   [2021]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 028/177] ath10k: Fix TKIP Michael MIC verification for PCIe
    Date
    From: Wen Gong <wgong@codeaurora.org>

    commit 0dc267b13f3a7e8424a898815dd357211b737330 upstream.

    TKIP Michael MIC was not verified properly for PCIe cases since the
    validation steps in ieee80211_rx_h_michael_mic_verify() in mac80211 did
    not get fully executed due to unexpected flag values in
    ieee80211_rx_status.

    Fix this by setting the flags property to meet mac80211 expectations for
    performing Michael MIC validation there. This fixes CVE-2020-26141. It
    does the same as ath10k_htt_rx_proc_rx_ind_hl() for SDIO which passed
    MIC verification case. This applies only to QCA6174/QCA9377 PCIe.

    Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1

    Cc: stable@vger.kernel.org
    Signed-off-by: Wen Gong <wgong@codeaurora.org>
    Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
    Link: https://lore.kernel.org/r/20210511200110.c3f1d42c6746.I795593fcaae941c471425b8c7d5f7bb185d29142@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/wireless/ath/ath10k/htt_rx.c | 10 ++++++++++
    1 file changed, 10 insertions(+)

    --- a/drivers/net/wireless/ath/ath10k/htt_rx.c
    +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
    @@ -1967,6 +1967,11 @@ static void ath10k_htt_rx_h_mpdu(struct
    }

    ath10k_htt_rx_h_csum_offload(msdu);
    +
    + if (frag && !fill_crypt_header &&
    + enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA)
    + status->flag &= ~RX_FLAG_MMIC_STRIPPED;
    +
    ath10k_htt_rx_h_undecap(ar, msdu, status, first_hdr, enctype,
    is_decrypted);

    @@ -1984,6 +1989,11 @@ static void ath10k_htt_rx_h_mpdu(struct

    hdr = (void *)msdu->data;
    hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
    +
    + if (frag && !fill_crypt_header &&
    + enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA)
    + status->flag &= ~RX_FLAG_IV_STRIPPED &
    + ~RX_FLAG_MMIC_STRIPPED;
    }
    }


    \
     
     \ /
      Last update: 2021-05-31 17:17    [W:7.620 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site