소스 검색

qcacld-3.0: Drop mcast and plaintext frags in protected network

Multicast frames should not be fragmented and plaintext
frags should not be reassembeld in protected network.

Fix is to drop mcast frags and plaintext frags received
in protected network.

Change-Id: I98cf0715f5832f2f86f86b79dbdbc3a7c86dbfd0
CRs-Fixed: 2860245
Yeshwanth Sriram Guntuka 4 년 전
부모
커밋
403bc635eb
1개의 변경된 파일24개의 추가작업 그리고 0개의 파일을 삭제
  1. 24 0
      core/dp/txrx/ol_rx_defrag.c

+ 24 - 0
core/dp/txrx/ol_rx_defrag.c

@@ -416,6 +416,8 @@ ol_rx_reorder_store_frag(ol_txrx_pdev_handle pdev,
 	struct ol_rx_reorder_array_elem_t *rx_reorder_array_elem;
 	struct ol_rx_reorder_array_elem_t *rx_reorder_array_elem;
 	uint16_t frxseq, rxseq, seq;
 	uint16_t frxseq, rxseq, seq;
 	htt_pdev_handle htt_pdev = pdev->htt_pdev;
 	htt_pdev_handle htt_pdev = pdev->htt_pdev;
+	void *rx_desc;
+	uint8_t index;
 
 
 	seq = seq_num & peer->tids_rx_reorder[tid].win_sz_mask;
 	seq = seq_num & peer->tids_rx_reorder[tid].win_sz_mask;
 	qdf_assert(seq == 0);
 	qdf_assert(seq == 0);
@@ -429,6 +431,28 @@ ol_rx_reorder_store_frag(ol_txrx_pdev_handle pdev,
 		IEEE80211_SEQ_FRAG_MASK;
 		IEEE80211_SEQ_FRAG_MASK;
 	more_frag = mac_hdr->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
 	more_frag = mac_hdr->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
 
 
+	rx_desc = htt_rx_msdu_desc_retrieve(htt_pdev, frag);
+	qdf_assert(htt_rx_msdu_has_wlan_mcast_flag(htt_pdev, rx_desc));
+	index = htt_rx_msdu_is_wlan_mcast(htt_pdev, rx_desc) ?
+		txrx_sec_mcast : txrx_sec_ucast;
+
+	/*
+	 * Multicast/Broadcast frames should not be fragmented so drop
+	 * such frames.
+	 */
+	if (index != txrx_sec_ucast) {
+		ol_rx_frames_free(htt_pdev, frag);
+		return;
+	}
+
+	if (peer->security[index].sec_type != htt_sec_type_none &&
+	    !htt_rx_mpdu_is_encrypted(htt_pdev, rx_desc)) {
+		ol_txrx_err("Unencrypted fragment received in security mode %d",
+			    peer->security[index].sec_type);
+		ol_rx_frames_free(htt_pdev, frag);
+		return;
+	}
+
 	if ((!more_frag) && (!fragno) && (!rx_reorder_array_elem->head)) {
 	if ((!more_frag) && (!fragno) && (!rx_reorder_array_elem->head)) {
 		rx_reorder_array_elem->head = frag;
 		rx_reorder_array_elem->head = frag;
 		rx_reorder_array_elem->tail = frag;
 		rx_reorder_array_elem->tail = frag;