Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd371c75 authored by Dundi Raviteja's avatar Dundi Raviteja Committed by Gerrit - the friendly Code Review server
Browse files

wlan: Drop invalid AMSDU subframe 

Drop AMSDU subframes if AMSDU subframe header's DA
is equal to LLC header.

Change-Id: Ieeb680cd395f275fe2b3bd98afdf4a2e57609b10
CRs-Fixed: 2867994
parent 12168f39

CORE/TL/src/wlan_qct_tl.c

+10 −0
Original line number Diff line number Diff line
@@ -8928,6 +8928,7 @@ WLANTL_STARxConn 
   v_PVOID_t                aucBDHeader;

   v_U8_t                   ucTid;

   WLANTL_RxMetaInfoType    wRxMetaInfo;

   v_U8_t                   ucAsf; /* AMSDU sub frame */

  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/



  /*------------------------------------------------------------------------
@@ -8978,6 +8979,7 @@ WLANTL_STARxConn 
  usMPDULen     = (v_U16_t)WDA_GET_RX_MPDU_LEN(aucBDHeader);

  ucMPDUHLen    = (v_U8_t)WDA_GET_RX_MPDU_HEADER_LEN(aucBDHeader);

  ucTid         = (v_U8_t)WDA_GET_RX_TID(aucBDHeader);

  ucAsf         = (v_U8_t)WDA_GET_RX_ASF(aucBDHeader);



  vos_pkt_get_packet_length( vosDataBuff, &usPktLen);
@@ -8995,6 +8997,14 @@ WLANTL_STARxConn 
    return VOS_STATUS_SUCCESS;

  }



  if (ucAsf) {

    vos_pkt_return_packet(vosDataBuff);

    *pvosDataBuff = NULL;

    VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,

              "WLAN TL: AMSDU frames are not allowed while authentication - dropping");

    return VOS_STATUS_SUCCESS;

  }



  vosStatus = WLANTL_GetEtherType(aucBDHeader,vosDataBuff,ucMPDUHLen,&usEtherType);

  

  if( VOS_IS_STATUS_SUCCESS(vosStatus) )

CORE/TL/src/wlan_qct_tl_ba.c

+22 −0
Original line number Diff line number Diff line
@@ -844,6 +844,8 @@ WLANTL_AMSDUProcess 
  v_U16_t         packetLength; 

  static v_U32_t  numAMSDUFrames;

  vos_pkt_t*      vosDataBuff;

  uint8_t llc_hdr[6] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};



  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/

  /*------------------------------------------------------------------------

    Sanity check
@@ -922,6 +924,7 @@ WLANTL_AMSDUProcess 
    pClientSTA->ucMPDUHeaderLen = ucMPDUHLen;

    vos_mem_copy(pClientSTA->aucMPDUHeader, MPDUHeaderAMSDUHeader, ucMPDUHLen);

    /* AMSDU header stored to handle garbage data within next frame */

    pClientSTA->drop_amsdu = false;

  }

  else

  {
@@ -959,6 +962,25 @@ WLANTL_AMSDUProcess 
    return VOS_STATUS_SUCCESS; /*Not a transport error*/ 

  }



  if (pClientSTA->drop_amsdu) {

         vos_pkt_return_packet(vosDataBuff);

         *ppVosDataBuff = NULL;

         return VOS_STATUS_SUCCESS;

  }



  /**

   * Set drop_amsdu flag and drop AMSDU subframe if AMSDU subframe DA

   * is equal to LLC header

   */

   if (vos_mem_compare2(MPDUHeaderAMSDUHeader + ucMPDUHLen, llc_hdr, 6) == 0) {

      pClientSTA->drop_amsdu = true;

      vos_pkt_return_packet(vosDataBuff);

      *ppVosDataBuff = NULL;

      VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,

                "WLAN TL:Invalid AMSDU frame - dropping");

      return VOS_STATUS_SUCCESS;

   }



  /* Find Padding and remove */

  vos_mem_copy(&subFrameLength, MPDUHeaderAMSDUHeader + ucMPDUHLen + WLANTL_AMSDU_SUBFRAME_LEN_OFFSET, sizeof(v_U16_t));

  subFrameLength = vos_be16_to_cpu(subFrameLength);

CORE/TL/src/wlan_qct_tli.h

+3 −0
Original line number Diff line number Diff line
@@ -603,6 +603,9 @@ typedef struct 
  /* Pointer to the root of the chain */

  vos_pkt_t*                    vosAMSDUChain;



  /* Drop any invalid amsdu */

  bool drop_amsdu;



  /* Used for saving/restoring frame header for 802.3/11 AMSDU sub-frames */

  v_U8_t                        aucMPDUHeader[WLANTL_MPDU_HEADER_LEN];