A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Drop fragmented multicast/broadcast frames

Browse source 
CVE-2020-26145
Broadcast and multicast frames should never be fragmented. Several devices
process broadcasted fragments as normal unfragmented frames. Moreover, some
devices accept plaintext fragmented broadcast or multicast frames in
protected Wi-Fi networks. An adversary can abuse this to inject packets
by encapsulating them in a fragmented plaintext broadcast frame. Even
unicast packets can be encapsulated in broadcast Wi-Fi frames and hence
be injected.

Change-Id: I3181a05e177cf9374a14edb748bc5001d058e0f3
CRs-Fixed: 2893212
This commit is contained in:
Varsha Mishra 2021-01-26 21:08:04 +05:30 • committed by Madan Koyyalamudi
commit 0549e6ec4f
1 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
dp/wifi3.0/dp_rx_defrag.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
* Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@ -932,6 +932,17 @@ dp_rx_construct_fraglist(struct dp_peer *peer, int tid, qdf_nbuf_t head,
prev_pn128[0] = cur_pn128[0];
prev_pn128[1] = cur_pn128[1];
/*
* Broadcast and multicast frames should never be fragmented.
* Iterating through all msdus and dropping fragments if even
* one of them has mcast/bcast destination address.
*/
if (hal_rx_msdu_is_wlan_mcast(msdu)) {
QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
"Dropping multicast/broadcast fragments");
return QDF_STATUS_E_FAILURE;
}
dp_rx_frag_pull_hdr(msdu, hdrsize);
len += qdf_nbuf_len(msdu);
msdu = qdf_nbuf_next(msdu);