Return-path: Received: from mail-qt0-f194.google.com ([209.85.216.194]:38123 "EHLO mail-qt0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751451AbeA3Lrp (ORCPT ); Tue, 30 Jan 2018 06:47:45 -0500 Received: by mail-qt0-f194.google.com with SMTP id z10so16811589qti.5 for ; Tue, 30 Jan 2018 03:47:45 -0800 (PST) Subject: Re: [PATCH] brcmfmac: detect & reject faked packet generated by a firmware To: =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= , Kalle Valo References: <20180130090922.30346-1-zajec5@gmail.com> Cc: Franky Lin , Hante Meuleman , Chi-Hsien Lin , Wright Feng , Pieter-Paul Giesberts , linux-wireless@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com, brcm80211-dev-list@cypress.com, =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= From: Arend van Spriel Message-ID: <5A705B5E.5070906@broadcom.com> (sfid-20180130_124749_954691_F7EB8BD0) Date: Tue, 30 Jan 2018 12:47:42 +0100 MIME-Version: 1.0 In-Reply-To: <20180130090922.30346-1-zajec5@gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Sender: linux-wireless-owner@vger.kernel.org List-ID: On 1/30/2018 10:09 AM, Rafał Miłecki wrote: > From: Rafał Miłecki > > When using 4366b1 and 4366c0 chipsets with more recent firmwares > 1) 10.10 (TOB) (r663589) > 2) 10.10.122.20 (r683106) > respectively, it is impossible to use brcmfmac with interface in AP > mode. With the AP interface bridged and multicast used, no STA will be > able to associate; the STA will be immediately disassociated when > attempting to associate. > > Debugging revealed this to be caused by a "faked" packet (generated by > firmware), that is passed to the networking subsystem and then back to > the firmware. Fortunately this packet is easily identified and can be > detected and ignored as a workaround for misbehaving firmware. I am actually wondering what this packet is. Have you checked in brcmf_msgbuf_process_rx_complete(). I am curious what buflen is there and what eth_type_trans() will do to the packet, ie. what protocol. As everything should be 802.3 we could/should add a length check of 14 bytes. Regards, Arend > Signed-off-by: Rafał Miłecki > --- > .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 ++++++++++++++++++++++ > 1 file changed, 46 insertions(+)