Return-path: <linux-wireless-owner@vger.kernel.org>
Received: from mail-wm0-f54.google.com ([74.125.82.54]:34449 "EHLO
        mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752618AbeAaSCU (ORCPT
        <rfc822;linux-wireless@vger.kernel.org>);
        Wed, 31 Jan 2018 13:02:20 -0500
Received: by mail-wm0-f54.google.com with SMTP id j21so9587127wmh.1
        for <linux-wireless@vger.kernel.org>; Wed, 31 Jan 2018 10:02:20 -0800 (PST)
Subject: Re: [PATCH] brcmfmac: detect & reject faked packet generated by a
 firmware
To: Hante Meuleman <hante.meuleman@broadcom.com>,
        =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= <rafal@milecki.pl>
References: <20180130090922.30346-1-zajec5@gmail.com>
 <5A705B5E.5070906@broadcom.com> <e6719fcc4080afc43d62d370ad9cfd34@milecki.pl>
 <5A71D08B.7090905@broadcom.com>
 <4f6223b8083ed69432493a37d4f45b69@mail.gmail.com>
Cc: =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= <zajec5@gmail.com>,
        Kalle Valo <kvalo@codeaurora.org>,
        Franky Lin <franky.lin@broadcom.com>,
        Chi-Hsien Lin <chi-hsien.lin@cypress.com>,
        Wright Feng <wright.feng@cypress.com>,
        Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>,
        linux-wireless@vger.kernel.org,
        "BRCM80211-DEV-LIST,PDL" <brcm80211-dev-list.pdl@broadcom.com>,
        brcm80211-dev-list@cypress.com
From: Arend van Spriel <arend.vanspriel@broadcom.com>
Message-ID: <5A7204AA.4040801@broadcom.com> (sfid-20180131_190223_957311_5D0EE11C)
Date: Wed, 31 Jan 2018 19:02:18 +0100
MIME-Version: 1.0
In-Reply-To: <4f6223b8083ed69432493a37d4f45b69@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Sender: linux-wireless-owner@vger.kernel.org
List-ID: <linux-wireless.vger.kernel.org>

On 1/31/2018 5:14 PM, Hante Meuleman wrote:
> It is an 802.2 frame, more specifically a LLC XID frames. So why it exists?
> And more over, why would we crash as an result? Decoding info can be found
> here:
>
> https://www.cisco.com/c/en/us/support/docs/ibm-technologies/logical-link-control-llc/12247-45.html#con3
>
> The frame was likely sent by the stack from remote site PC, should be
> possible to capture with tcpdump.
>
> I've seen these frames before, but don’t know what they are for. The frame
> appears to be correctly encoded. The ethertype, is not a type, but a len
> field. The only protocol with such a short len allowed is llc, see also

Could it be related to the fact that the interface is put in a bridge 
and hence the device is put in promiscuous mode? Anyway, I did not read 
anything about a firmware crash. Just that clients could not associate.

Regards,
Arend