mirror of
https://github.com/Telecominfraproject/wlan-ap.git
synced 2025-12-20 02:43:38 +00:00
85 lines
3.1 KiB
Diff
85 lines
3.1 KiB
Diff
From a60eea4345deccc023fd629c571fe7ca068bb878 Mon Sep 17 00:00:00 2001
|
|
From: Sriram R <srirrama@codeaurora.org>
|
|
Date: Thu, 10 Dec 2020 14:20:50 +0530
|
|
Subject: [PATCH] ath11k: Clear the fragment cache during key install
|
|
|
|
Currently the fragment cache setup during peer assoc is
|
|
cleared only during peer delete. In case a key reinstallation
|
|
happens with the same peer, the same fragment cache with old
|
|
fragments added before key installation could be clubbed
|
|
with fragments received after. This might be exploited
|
|
to mix fragments of different data resulting in a proper
|
|
unintended reassembled packet to be passed up the stack.
|
|
|
|
Hence flush the fragment cache on every key installation.
|
|
|
|
Signed-off-by: Sriram R <srirrama@codeaurora.org>
|
|
---
|
|
|
|
drivers/net/wireless/ath/ath11k/dp_rx.c | 18 ++++++++++++++++++
|
|
drivers/net/wireless/ath/ath11k/dp_rx.h | 1 +
|
|
drivers/net/wireless/ath/ath11k/mac.c | 6 ++++++
|
|
3 files changed, 25 insertions(+)
|
|
|
|
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
|
|
index 1d9aa1b..3382f8b 100644
|
|
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
|
|
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
|
|
@@ -852,6 +852,24 @@ static void ath11k_dp_rx_frags_cleanup(struct dp_rx_tid *rx_tid, bool rel_link_d
|
|
__skb_queue_purge(&rx_tid->rx_frags);
|
|
}
|
|
|
|
+void ath11k_peer_frags_flush(struct ath11k *ar, struct ath11k_peer *peer)
|
|
+{
|
|
+ struct dp_rx_tid *rx_tid;
|
|
+ int i;
|
|
+
|
|
+ lockdep_assert_held(&ar->ab->base_lock);
|
|
+
|
|
+ for (i = 0; i <= IEEE80211_NUM_TIDS; i++) {
|
|
+ rx_tid = &peer->rx_tid[i];
|
|
+
|
|
+ spin_unlock_bh(&ar->ab->base_lock);
|
|
+ del_timer_sync(&rx_tid->frag_timer);
|
|
+ spin_lock_bh(&ar->ab->base_lock);
|
|
+
|
|
+ ath11k_dp_rx_frags_cleanup(rx_tid, true);
|
|
+ }
|
|
+}
|
|
+
|
|
void ath11k_peer_rx_tid_cleanup(struct ath11k *ar, struct ath11k_peer *peer)
|
|
{
|
|
struct dp_rx_tid *rx_tid;
|
|
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.h b/drivers/net/wireless/ath/ath11k/dp_rx.h
|
|
index bf39931..623da3b 100644
|
|
--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
|
|
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
|
|
@@ -49,6 +49,7 @@ int ath11k_dp_peer_rx_pn_replay_config(struct ath11k_vif *arvif,
|
|
const u8 *peer_addr,
|
|
enum set_key_cmd key_cmd,
|
|
struct ieee80211_key_conf *key);
|
|
+void ath11k_peer_frags_flush(struct ath11k *ar, struct ath11k_peer *peer);
|
|
void ath11k_peer_rx_tid_cleanup(struct ath11k *ar, struct ath11k_peer *peer);
|
|
void ath11k_peer_rx_tid_delete(struct ath11k *ar,
|
|
struct ath11k_peer *peer, u8 tid);
|
|
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
|
|
index 4df425d..9d0ff15 100644
|
|
--- a/drivers/net/wireless/ath/ath11k/mac.c
|
|
+++ b/drivers/net/wireless/ath/ath11k/mac.c
|
|
@@ -2779,6 +2779,12 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
|
|
*/
|
|
spin_lock_bh(&ab->base_lock);
|
|
peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
|
|
+
|
|
+ /* flush the fragments cache during key (re)install to
|
|
+ * ensure all frags in the new frag list belong to the same key.
|
|
+ */
|
|
+ if (peer && cmd == SET_KEY)
|
|
+ ath11k_peer_frags_flush(ar, peer);
|
|
spin_unlock_bh(&ab->base_lock);
|
|
|
|
if (!peer) {
|
|
--
|
|
2.7.4
|
|
|