@@ -2530,6 +2530,29 @@ static void ath12k_dp_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *nap
2530
2530
ieee80211_rx_napi (ath12k_ar_to_hw (ar ), pubsta , msdu , napi );
2531
2531
}
2532
2532
2533
+ static bool ath12k_dp_rx_check_nwifi_hdr_len_valid (struct ath12k_base * ab ,
2534
+ struct hal_rx_desc * rx_desc ,
2535
+ struct sk_buff * msdu )
2536
+ {
2537
+ struct ieee80211_hdr * hdr ;
2538
+ u8 decap_type ;
2539
+ u32 hdr_len ;
2540
+
2541
+ decap_type = ath12k_dp_rx_h_decap_type (ab , rx_desc );
2542
+ if (decap_type != DP_RX_DECAP_TYPE_NATIVE_WIFI )
2543
+ return true;
2544
+
2545
+ hdr = (struct ieee80211_hdr * )msdu -> data ;
2546
+ hdr_len = ieee80211_hdrlen (hdr -> frame_control );
2547
+
2548
+ if ((likely (hdr_len <= DP_MAX_NWIFI_HDR_LEN )))
2549
+ return true;
2550
+
2551
+ ab -> soc_stats .invalid_rbm ++ ;
2552
+ WARN_ON_ONCE (1 );
2553
+ return false;
2554
+ }
2555
+
2533
2556
static int ath12k_dp_rx_process_msdu (struct ath12k * ar ,
2534
2557
struct sk_buff * msdu ,
2535
2558
struct sk_buff_head * msdu_list ,
@@ -2588,6 +2611,11 @@ static int ath12k_dp_rx_process_msdu(struct ath12k *ar,
2588
2611
}
2589
2612
}
2590
2613
2614
+ if (unlikely (!ath12k_dp_rx_check_nwifi_hdr_len_valid (ab , rx_desc , msdu ))) {
2615
+ ret = - EINVAL ;
2616
+ goto free_out ;
2617
+ }
2618
+
2591
2619
ath12k_dp_rx_h_ppdu (ar , rx_desc , rx_status );
2592
2620
ath12k_dp_rx_h_mpdu (ar , msdu , rx_desc , rx_status );
2593
2621
@@ -2978,6 +3006,9 @@ static int ath12k_dp_rx_h_verify_tkip_mic(struct ath12k *ar, struct ath12k_peer
2978
3006
RX_FLAG_IV_STRIPPED | RX_FLAG_DECRYPTED ;
2979
3007
skb_pull (msdu , hal_rx_desc_sz );
2980
3008
3009
+ if (unlikely (!ath12k_dp_rx_check_nwifi_hdr_len_valid (ab , rx_desc , msdu )))
3010
+ return - EINVAL ;
3011
+
2981
3012
ath12k_dp_rx_h_ppdu (ar , rx_desc , rxs );
2982
3013
ath12k_dp_rx_h_undecap (ar , msdu , rx_desc ,
2983
3014
HAL_ENCRYPT_TYPE_TKIP_MIC , rxs , true);
@@ -3720,6 +3751,9 @@ static int ath12k_dp_rx_h_null_q_desc(struct ath12k *ar, struct sk_buff *msdu,
3720
3751
skb_put (msdu , hal_rx_desc_sz + l3pad_bytes + msdu_len );
3721
3752
skb_pull (msdu , hal_rx_desc_sz + l3pad_bytes );
3722
3753
}
3754
+ if (unlikely (!ath12k_dp_rx_check_nwifi_hdr_len_valid (ab , desc , msdu )))
3755
+ return - EINVAL ;
3756
+
3723
3757
ath12k_dp_rx_h_ppdu (ar , desc , status );
3724
3758
3725
3759
ath12k_dp_rx_h_mpdu (ar , msdu , desc , status );
@@ -3764,7 +3798,7 @@ static bool ath12k_dp_rx_h_reo_err(struct ath12k *ar, struct sk_buff *msdu,
3764
3798
return drop ;
3765
3799
}
3766
3800
3767
- static void ath12k_dp_rx_h_tkip_mic_err (struct ath12k * ar , struct sk_buff * msdu ,
3801
+ static bool ath12k_dp_rx_h_tkip_mic_err (struct ath12k * ar , struct sk_buff * msdu ,
3768
3802
struct ieee80211_rx_status * status )
3769
3803
{
3770
3804
struct ath12k_base * ab = ar -> ab ;
@@ -3782,13 +3816,17 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu,
3782
3816
skb_put (msdu , hal_rx_desc_sz + l3pad_bytes + msdu_len );
3783
3817
skb_pull (msdu , hal_rx_desc_sz + l3pad_bytes );
3784
3818
3819
+ if (unlikely (!ath12k_dp_rx_check_nwifi_hdr_len_valid (ab , desc , msdu )))
3820
+ return true;
3821
+
3785
3822
ath12k_dp_rx_h_ppdu (ar , desc , status );
3786
3823
3787
3824
status -> flag |= (RX_FLAG_MMIC_STRIPPED | RX_FLAG_MMIC_ERROR |
3788
3825
RX_FLAG_DECRYPTED );
3789
3826
3790
3827
ath12k_dp_rx_h_undecap (ar , msdu , desc ,
3791
3828
HAL_ENCRYPT_TYPE_TKIP_MIC , status , false);
3829
+ return false;
3792
3830
}
3793
3831
3794
3832
static bool ath12k_dp_rx_h_rxdma_err (struct ath12k * ar , struct sk_buff * msdu ,
@@ -3807,7 +3845,7 @@ static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu,
3807
3845
case HAL_REO_ENTR_RING_RXDMA_ECODE_TKIP_MIC_ERR :
3808
3846
err_bitmap = ath12k_dp_rx_h_mpdu_err (ab , rx_desc );
3809
3847
if (err_bitmap & HAL_RX_MPDU_ERR_TKIP_MIC ) {
3810
- ath12k_dp_rx_h_tkip_mic_err (ar , msdu , status );
3848
+ drop = ath12k_dp_rx_h_tkip_mic_err (ar , msdu , status );
3811
3849
break ;
3812
3850
}
3813
3851
fallthrough ;
0 commit comments