|
Oliver Neukum |
a5c8a1 |
From e3fb3d4418fce5484dfe7995fcd94c18b10a431a Mon Sep 17 00:00:00 2001
|
|
Oliver Neukum |
a5c8a1 |
From: Wen Gong <quic_wgong@quicinc.com>
|
|
Oliver Neukum |
a5c8a1 |
Date: Mon, 10 Jan 2022 16:24:13 +0200
|
|
Oliver Neukum |
a5c8a1 |
Subject: [PATCH] ath10k: fix memory overwrite of the WoWLAN wakeup packet
|
|
Oliver Neukum |
a5c8a1 |
pattern
|
|
Oliver Neukum |
a5c8a1 |
Git-commit: e3fb3d4418fce5484dfe7995fcd94c18b10a431a
|
|
Oliver Neukum |
a5c8a1 |
References: git-fixes
|
|
Oliver Neukum |
a5c8a1 |
Patch-mainline: v5.18-rc1
|
|
Oliver Neukum |
a5c8a1 |
|
|
Oliver Neukum |
a5c8a1 |
In function ath10k_wow_convert_8023_to_80211(), it will do memcpy for
|
|
Oliver Neukum |
a5c8a1 |
the new->pattern, and currently the new->pattern and new->mask is same
|
|
Oliver Neukum |
a5c8a1 |
with the old, then the memcpy of new->pattern will also overwrite the
|
|
Oliver Neukum |
a5c8a1 |
old->pattern, because the header format of new->pattern is 802.11,
|
|
Oliver Neukum |
a5c8a1 |
its length is larger than the old->pattern which is 802.3. Then the
|
|
Oliver Neukum |
a5c8a1 |
operation of "Copy frame body" will copy a mistake value because the
|
|
Oliver Neukum |
a5c8a1 |
body memory has been overwrite when memcpy the new->pattern.
|
|
Oliver Neukum |
a5c8a1 |
|
|
Oliver Neukum |
a5c8a1 |
Assign another empty value to new_pattern to avoid the overwrite issue.
|
|
Oliver Neukum |
a5c8a1 |
|
|
Oliver Neukum |
a5c8a1 |
Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049
|
|
Oliver Neukum |
a5c8a1 |
|
|
Oliver Neukum |
a5c8a1 |
Fixes: fa3440fa2fa1 ("ath10k: convert wow pattern from 802.3 to 802.11")
|
|
Oliver Neukum |
a5c8a1 |
Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
|
|
Oliver Neukum |
a5c8a1 |
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
|
|
Oliver Neukum |
a5c8a1 |
Link: https://lore.kernel.org/r/20211222031347.25463-1-quic_wgong@quicinc.com
|
|
Oliver Neukum |
a5c8a1 |
Signed-off-by: Oliver Neukum <oneukum@suse.com>
|
|
Oliver Neukum |
a5c8a1 |
---
|
|
Oliver Neukum |
a5c8a1 |
drivers/net/wireless/ath/ath10k/wow.c | 7 ++++---
|
|
Oliver Neukum |
a5c8a1 |
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
Oliver Neukum |
a5c8a1 |
|
|
Oliver Neukum |
a5c8a1 |
diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c
|
|
Oliver Neukum |
a5c8a1 |
index 7d65c115669f..20b9aa8ddf7d 100644
|
|
Oliver Neukum |
a5c8a1 |
--- a/drivers/net/wireless/ath/ath10k/wow.c
|
|
Oliver Neukum |
a5c8a1 |
+++ b/drivers/net/wireless/ath/ath10k/wow.c
|
|
Oliver Neukum |
a5c8a1 |
@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif,
|
|
Oliver Neukum |
a5c8a1 |
if (patterns[i].mask[j / 8] & BIT(j % 8))
|
|
Oliver Neukum |
a5c8a1 |
bitmask[j] = 0xff;
|
|
Oliver Neukum |
a5c8a1 |
old_pattern.mask = bitmask;
|
|
Oliver Neukum |
a5c8a1 |
- new_pattern = old_pattern;
|
|
Oliver Neukum |
a5c8a1 |
|
|
Oliver Neukum |
a5c8a1 |
if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) {
|
|
Oliver Neukum |
a5c8a1 |
- if (patterns[i].pkt_offset < ETH_HLEN)
|
|
Oliver Neukum |
a5c8a1 |
+ if (patterns[i].pkt_offset < ETH_HLEN) {
|
|
Oliver Neukum |
a5c8a1 |
ath10k_wow_convert_8023_to_80211(&new_pattern,
|
|
Oliver Neukum |
a5c8a1 |
&old_pattern);
|
|
Oliver Neukum |
a5c8a1 |
- else
|
|
Oliver Neukum |
a5c8a1 |
+ } else {
|
|
Oliver Neukum |
a5c8a1 |
+ new_pattern = old_pattern;
|
|
Oliver Neukum |
a5c8a1 |
new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN;
|
|
Oliver Neukum |
a5c8a1 |
+ }
|
|
Oliver Neukum |
a5c8a1 |
}
|
|
Oliver Neukum |
a5c8a1 |
|
|
Oliver Neukum |
a5c8a1 |
if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))
|
|
Oliver Neukum |
a5c8a1 |
--
|
|
Oliver Neukum |
a5c8a1 |
2.40.0
|
|
Oliver Neukum |
a5c8a1 |
|