wlan: Drop invalid AMSDU subframe

Drop AMSDU subframes if AMSDU subframe header's DA
is equal to LLC header.

Change-Id: Ieeb680cd395f275fe2b3bd98afdf4a2e57609b10
CRs-Fixed: 2867994

drivers/staging/prima/CORE/TL/src/wlan_qct_tl.c

@@ -7231,6 +7231,7 @@ WLANTL_STARxConn
    v_PVOID_t                aucBDHeader;
    v_U8_t                   ucTid;
    WLANTL_RxMetaInfoType    wRxMetaInfo;
+   v_U8_t                   ucAsf; /* AMSDU sub frame */
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
 
   /*------------------------------------------------------------------------
@@ -7281,6 +7282,7 @@ WLANTL_STARxConn
   usMPDULen     = (v_U16_t)WDA_GET_RX_MPDU_LEN(aucBDHeader);
   ucMPDUHLen    = (v_U8_t)WDA_GET_RX_MPDU_HEADER_LEN(aucBDHeader);
   ucTid         = (v_U8_t)WDA_GET_RX_TID(aucBDHeader);
+  ucAsf         = (v_U8_t)WDA_GET_RX_ASF(aucBDHeader);
 
   vos_pkt_get_packet_length( vosDataBuff, &usPktLen);
 
@@ -7298,6 +7300,14 @@ WLANTL_STARxConn
     return VOS_STATUS_SUCCESS;
   }
 
+  if (ucAsf) {
+    vos_pkt_return_packet(vosDataBuff);
+    *pvosDataBuff = NULL;
+    VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "WLAN TL: AMSDU frames are not allowed while authentication - dropping");
+    return VOS_STATUS_SUCCESS;
+  }
+
   vosStatus = WLANTL_GetEtherType(aucBDHeader,vosDataBuff,ucMPDUHLen,&usEtherType);
   
   if( VOS_IS_STATUS_SUCCESS(vosStatus) )

drivers/staging/prima/CORE/TL/src/wlan_qct_tl_ba.c

@@ -872,6 +872,8 @@ WLANTL_AMSDUProcess
   v_U16_t         packetLength; 
   static v_U32_t  numAMSDUFrames;
   vos_pkt_t*      vosDataBuff;
+  uint8_t llc_hdr[6] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
   /*------------------------------------------------------------------------
     Sanity check
@@ -950,6 +952,7 @@ WLANTL_AMSDUProcess
     pClientSTA->ucMPDUHeaderLen = ucMPDUHLen;
     memcpy(pClientSTA->aucMPDUHeader, MPDUHeaderAMSDUHeader, ucMPDUHLen);
     /* AMSDU header stored to handle garbage data within next frame */
+    pClientSTA->drop_amsdu = false;
   }
   else
   {
@@ -987,6 +990,25 @@ WLANTL_AMSDUProcess
     return VOS_STATUS_SUCCESS; /*Not a transport error*/ 
   }
 
+  if (pClientSTA->drop_amsdu) {
+         vos_pkt_return_packet(vosDataBuff);
+         *ppVosDataBuff = NULL;
+         return VOS_STATUS_SUCCESS;
+  }
+
+  /**
+   * Set drop_amsdu flag and drop AMSDU subframe if AMSDU subframe DA
+   * is equal to LLC header
+   */
+   if (vos_mem_compare2(MPDUHeaderAMSDUHeader + ucMPDUHLen, llc_hdr, 6) == 0) {
+      pClientSTA->drop_amsdu = true;
+      vos_pkt_return_packet(vosDataBuff);
+      *ppVosDataBuff = NULL;
+      VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "WLAN TL:Invalid AMSDU frame - dropping");
+      return VOS_STATUS_SUCCESS;
+   }
+
   /* Find Padding and remove */
   memcpy(&subFrameLength, MPDUHeaderAMSDUHeader + ucMPDUHLen + WLANTL_AMSDU_SUBFRAME_LEN_OFFSET, sizeof(v_U16_t));
   subFrameLength = vos_be16_to_cpu(subFrameLength);

drivers/staging/prima/CORE/TL/src/wlan_qct_tli.h

@@ -531,6 +531,9 @@ typedef struct
   /* Pointer to the root of the chain */
   vos_pkt_t*                    vosAMSDUChain;
 
+  /* Drop any invalid amsdu */
+  bool drop_amsdu;
+
   /* Used for saving/restoring frame header for 802.3/11 AMSDU sub-frames */
   v_U8_t                        aucMPDUHeader[WLANTL_MPDU_HEADER_LEN];