2021-12-22 03:10:37

by Wen Gong

Subject: [PATCH] ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern

In function ath10k_wow_convert_8023_to_80211(), it will do memcpy for
the new->pattern, and currently the new->pattern and new->mask is same
with the old, then the memcpy of new->pattern will also overwrite the
old->pattern, because the header format of new->pattern is 802.11,
its length is larger than the old->pattern which is 802.3. Then the
operation of "Copy frame body" will copy a mistake value because the
body memory has been overwrite when memcpy the new->pattern.

Assign another empty value to new_pattern to avoid the overwrite issue.

Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049

Fixes: fa3440fa2fa1 ("ath10k: convert wow pattern from 802.3 to 802.11")
Signed-off-by: Wen Gong <[email protected]>
---
drivers/net/wireless/ath/ath10k/wow.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c
index 7d65c115669f..20b9aa8ddf7d 100644
--- a/drivers/net/wireless/ath/ath10k/wow.c
+++ b/drivers/net/wireless/ath/ath10k/wow.c
@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif,
if (patterns[i].mask[j / 8] & BIT(j % 8))
bitmask[j] = 0xff;
old_pattern.mask = bitmask;
- new_pattern = old_pattern;

if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) {
- if (patterns[i].pkt_offset < ETH_HLEN)
+ if (patterns[i].pkt_offset < ETH_HLEN) {
ath10k_wow_convert_8023_to_80211(&new_pattern,
&old_pattern);
- else
+ } else {
+ new_pattern = old_pattern;
new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN;
+ }
}

if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))

base-commit: 6629123e6a8ba405d270fd9cd70dc1ccb65e25de
--
2.31.1

2021-12-22 03:14:56

by Wen Gong

Subject: Re: [PATCH] ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern

please ignore this, I will send to ath10k group because this is ath10k
patch.

On 12/22/2021 11:10 AM, Wen Gong wrote:
> In function ath10k_wow_convert_8023_to_80211(), it will do memcpy for
> the new->pattern, and currently the new->pattern and new->mask is same
> with the old, then the memcpy of new->pattern will also overwrite the
> old->pattern, because the header format of new->pattern is 802.11,
> its length is larger than the old->pattern which is 802.3. Then the
> operation of "Copy frame body" will copy a mistake value because the
> body memory has been overwrite when memcpy the new->pattern.
>
> Assign another empty value to new_pattern to avoid the overwrite issue.
>
> Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049
>
> Fixes: fa3440fa2fa1 ("ath10k: convert wow pattern from 802.3 to 802.11")
> Signed-off-by: Wen Gong <[email protected]>
> ---
> drivers/net/wireless/ath/ath10k/wow.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c
> index 7d65c115669f..20b9aa8ddf7d 100644
> --- a/drivers/net/wireless/ath/ath10k/wow.c
> +++ b/drivers/net/wireless/ath/ath10k/wow.c
> @@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif,
> if (patterns[i].mask[j / 8] & BIT(j % 8))
> bitmask[j] = 0xff;
> old_pattern.mask = bitmask;
> - new_pattern = old_pattern;
>
> if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) {
> - if (patterns[i].pkt_offset < ETH_HLEN)
> + if (patterns[i].pkt_offset < ETH_HLEN) {
> ath10k_wow_convert_8023_to_80211(&new_pattern,
> &old_pattern);
> - else
> + } else {
> + new_pattern = old_pattern;
> new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN;
> + }
> }
>
> if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))
>
> base-commit: 6629123e6a8ba405d270fd9cd70dc1ccb65e25de