Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp2721419pxj; Mon, 31 May 2021 09:05:25 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwgtfc9ywPFZPbmJ45iJikqLgfCKSsgyQ3w6raxGUp6pvwG1HmQgMDt7BRRhI9JgAmBXvxX X-Received: by 2002:a92:d452:: with SMTP id r18mr5426597ilm.73.1622477125414; Mon, 31 May 2021 09:05:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1622477125; cv=none; d=google.com; s=arc-20160816; b=dNH9yTSbv8oBI5RELU1SUaBtdIPKgIM+m1d8Po45ouzDnTNh/ImW7toSWPMYuaNkcj e7itSu5HgCZAhsbB8n96PKJ7oMVyguixoCVWrT1ihB+YOiFQ5R/Xv4CWOOIl+H09ihZC fNXFXI4leXTuGg4YaqqzXtgAhTViEPzq/+ge46gqbbqPthmamcWvwPX4ZM2K2CNUvhtc w3ODmjRY2XwNFISXC+1WpNcCr+aJ29FhQe0R0OTmwU+9lTN9KK9TvbxuXEojlC6wHaeb hfXxx8gzANSol7ofn6w5DXgQ/QFlkpIPEoShCn5dsL8s0d+R+yUpN6TzKg5f3Koa5gyW plyQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=HFKUfJulu6q+umAnw4J4TJbwj0amsnGJUq4m0+Po+7U=; b=Dkt7PbKwZ/1HI3iOiy80DN5bdb9b4AoqNt5o9DtGTk6X8VD9cHAswc3X/EfnuNpA7A L2423Ttf/WL7kd6owB2hVFM7j1yPWzQZQcFyIO+Tpi5APxDf/6rvnyy1UcAfrALGMAjd xR7KWuDlxLX/9VyZew62ecSvatImn1UQT2bc1fQ18GP3uIOWE+SmBSe0w5BI4n9L7vqi DNDWceeRAJnD7bmnA4DypAW2jrijWevbAEJ3Wxxdk7UcKEeHi8hyR0fXMbKV9W7866Y1 H3r6ani2dS0g5j6QNX2sUD1xM/jVENMVrhNO/5GeNpniUn49z5mHSTnLApW8bHBPw5dL irng== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=xpgYApir; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id j10si14033344ilc.16.2021.05.31.09.05.11; Mon, 31 May 2021 09:05:25 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=xpgYApir; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233102AbhEaQFG (ORCPT + 99 others); Mon, 31 May 2021 12:05:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:60988 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233059AbhEaOfK (ORCPT ); Mon, 31 May 2021 10:35:10 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id E875061C47; Mon, 31 May 2021 13:50:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1622469042; bh=1dCvVlGuxfmLXgO3Knl11lfZ+HgO81o6Inj7BWyWH6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xpgYApiraIGAM+TEZRDtnDqRgNPGLaGuGhDoBOc6T7n4r+59QXCl2ohLYirjQ2Pzn 1SPNkpUbcCZx5v0yvqOwBQUIf2kvLoEx35OazHvhrIYSViZgquabUkbn5ual4TKpym YPRjWw02vKkx80s+ahbjC502GaFpU7jCNCKRhHUQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wen Gong , Jouni Malinen , Johannes Berg Subject: [PATCH 5.12 047/296] ath10k: drop fragments with multicast DA for SDIO Date: Mon, 31 May 2021 15:11:42 +0200 Message-Id: <20210531130705.411694840@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210531130703.762129381@linuxfoundation.org> References: <20210531130703.762129381@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Wen Gong commit 40e7462dad6f3d06efdb17d26539e61ab6e34db1 upstream. Fragmentation is not used with multicast frames. Discard unexpected fragments with multicast DA. This fixes CVE-2020-26145. Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049 Cc: stable@vger.kernel.org Signed-off-by: Wen Gong Signed-off-by: Jouni Malinen Link: https://lore.kernel.org/r/20210511200110.9ca6ca7945a9.I1e18b514590af17c155bda86699bc3a971a8dcf4@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/ath/ath10k/htt_rx.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/drivers/net/wireless/ath/ath10k/htt_rx.c +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c @@ -2617,6 +2617,13 @@ static bool ath10k_htt_rx_proc_rx_frag_i rx_desc = (struct htt_hl_rx_desc *)(skb->data + tot_hdr_len); rx_desc_info = __le32_to_cpu(rx_desc->info); + hdr = (struct ieee80211_hdr *)((u8 *)rx_desc + rx_hl->fw_desc.len); + + if (is_multicast_ether_addr(hdr->addr1)) { + /* Discard the fragment with multicast DA */ + goto err; + } + if (!MS(rx_desc_info, HTT_RX_DESC_HL_INFO_ENCRYPTED)) { spin_unlock_bh(&ar->data_lock); return ath10k_htt_rx_proc_rx_ind_hl(htt, &resp->rx_ind_hl, skb, @@ -2624,8 +2631,6 @@ static bool ath10k_htt_rx_proc_rx_frag_i HTT_RX_NON_TKIP_MIC); } - hdr = (struct ieee80211_hdr *)((u8 *)rx_desc + rx_hl->fw_desc.len); - if (ieee80211_has_retry(hdr->frame_control)) goto err;