Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

wlan: Drop invalid AMSDU subframe

Browse source 
Drop AMSDU subframes if AMSDU subframe header's DA
is equal to LLC header.

Change-Id: Ieeb680cd395f275fe2b3bd98afdf4a2e57609b10
CRs-Fixed: 2867994
This commit is contained in:
Dundi Raviteja 2021-03-05 21:03:57 +05:30 committed by Nolen Johnson
parent d25cb7e425
commit c08882d58a
3 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/staging/prima/CORE/TL/src/wlan_qct_tl.c
View file

@ -7231,6 +7231,7 @@ WLANTL_STARxConn
v_PVOID_t aucBDHeader;
v_U8_t ucTid;
WLANTL_RxMetaInfoType wRxMetaInfo;
v_U8_t ucAsf; /* AMSDU sub frame */
/*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
/*------------------------------------------------------------------------
@ -7281,6 +7282,7 @@ WLANTL_STARxConn
usMPDULen = (v_U16_t)WDA_GET_RX_MPDU_LEN(aucBDHeader);
ucMPDUHLen = (v_U8_t)WDA_GET_RX_MPDU_HEADER_LEN(aucBDHeader);
ucTid = (v_U8_t)WDA_GET_RX_TID(aucBDHeader);
ucAsf = (v_U8_t)WDA_GET_RX_ASF(aucBDHeader);
vos_pkt_get_packet_length( vosDataBuff, &usPktLen);
@ -7298,6 +7300,14 @@ WLANTL_STARxConn
return VOS_STATUS_SUCCESS;
}
if (ucAsf) {
vos_pkt_return_packet(vosDataBuff);
*pvosDataBuff = NULL;
VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
"WLAN TL: AMSDU frames are not allowed while authentication - dropping");
return VOS_STATUS_SUCCESS;
}
vosStatus = WLANTL_GetEtherType(aucBDHeader,vosDataBuff,ucMPDUHLen,&usEtherType);
if( VOS_IS_STATUS_SUCCESS(vosStatus) )

22
drivers/staging/prima/CORE/TL/src/wlan_qct_tl_ba.c
View file

@ -872,6 +872,8 @@ WLANTL_AMSDUProcess
v_U16_t packetLength;
static v_U32_t numAMSDUFrames;
vos_pkt_t* vosDataBuff;
uint8_t llc_hdr[6] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
/*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
/*------------------------------------------------------------------------
Sanity check
@ -950,6 +952,7 @@ WLANTL_AMSDUProcess
pClientSTA->ucMPDUHeaderLen = ucMPDUHLen;
memcpy(pClientSTA->aucMPDUHeader, MPDUHeaderAMSDUHeader, ucMPDUHLen);
/* AMSDU header stored to handle garbage data within next frame */
pClientSTA->drop_amsdu = false;
}
else
{
@ -987,6 +990,25 @@ WLANTL_AMSDUProcess
return VOS_STATUS_SUCCESS; /*Not a transport error*/
}
if (pClientSTA->drop_amsdu) {
vos_pkt_return_packet(vosDataBuff);
*ppVosDataBuff = NULL;
return VOS_STATUS_SUCCESS;
}
/**
* Set drop_amsdu flag and drop AMSDU subframe if AMSDU subframe DA
* is equal to LLC header
*/
if (vos_mem_compare2(MPDUHeaderAMSDUHeader + ucMPDUHLen, llc_hdr, 6) == 0) {
pClientSTA->drop_amsdu = true;
vos_pkt_return_packet(vosDataBuff);
*ppVosDataBuff = NULL;
VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
"WLAN TL:Invalid AMSDU frame - dropping");
return VOS_STATUS_SUCCESS;
}
/* Find Padding and remove */
memcpy(&subFrameLength, MPDUHeaderAMSDUHeader + ucMPDUHLen + WLANTL_AMSDU_SUBFRAME_LEN_OFFSET, sizeof(v_U16_t));
subFrameLength = vos_be16_to_cpu(subFrameLength);

3
drivers/staging/prima/CORE/TL/src/wlan_qct_tli.h
View file

@ -531,6 +531,9 @@ typedef struct
/* Pointer to the root of the chain */
vos_pkt_t* vosAMSDUChain;
/* Drop any invalid amsdu */
bool drop_amsdu;
/* Used for saving/restoring frame header for 802.3/11 AMSDU sub-frames */
v_U8_t aucMPDUHeader[WLANTL_MPDU_HEADER_LEN];