From 5df7339711d7bc32d239d5da581c8bc47505c08d Mon Sep 17 00:00:00 2001 From: Yeshwanth Sriram Guntuka Date: Tue, 2 Feb 2021 20:33:05 +0530 Subject: [PATCH] qcacld-3.0: Drop mcast and plaintext frags in protected network Multicast frames should not be fragmented and plaintext frags should not be reassembeld in protected network. Fix is to drop mcast frags and plaintext frags received in protected network. Change-Id: I6629c2351884b880525c10cf9259d506af89dd10 CVE-Fixed: CVE-2020-26145 Mot-CRs-fixed: (CR) CRs-Fixed: 2860245 Reviewed-on: https://gerrit.mot.com/1929644 SME-Granted: SME Approvals Granted SLTApproved: Slta Waiver Tested-by: Jira Key Reviewed-by: Bin Liu Submit-Approved: Jira Key --- core/dp/txrx/ol_rx_defrag.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/core/dp/txrx/ol_rx_defrag.c b/core/dp/txrx/ol_rx_defrag.c index fc5d50bb061b..5a225e1606e1 100644 --- a/core/dp/txrx/ol_rx_defrag.c +++ b/core/dp/txrx/ol_rx_defrag.c @@ -453,6 +453,28 @@ ol_rx_reorder_store_frag(ol_txrx_pdev_handle pdev, return; } + rx_desc = htt_rx_msdu_desc_retrieve(htt_pdev, frag); + qdf_assert(htt_rx_msdu_has_wlan_mcast_flag(htt_pdev, rx_desc)); + index = htt_rx_msdu_is_wlan_mcast(htt_pdev, rx_desc) ? + txrx_sec_mcast : txrx_sec_ucast; + + /* + * Multicast/Broadcast frames should not be fragmented so drop + * such frames. + */ + if (index != txrx_sec_ucast) { + ol_rx_frames_free(htt_pdev, frag); + return; + } + + if (peer->security[index].sec_type != htt_sec_type_none && + !htt_rx_mpdu_is_encrypted(htt_pdev, rx_desc)) { + ol_txrx_err("Unencrypted fragment received in security mode %d", + peer->security[index].sec_type); + ol_rx_frames_free(htt_pdev, frag); + return; + } + if ((!more_frag) && (!fragno) && (!rx_reorder_array_elem->head)) { rx_reorder_array_elem->head = frag; rx_reorder_array_elem->tail = frag;