forked from luck/tmp_suning_uos_patched
6abcc01e8b
commit 3edc6b0d6c061a70d8ca3c3c72eb1f58ce29bfb1 upstream. For some chips/drivers, e.g., QCA6174 with ath10k, the decryption is done by the hardware, and the Protected bit in the Frame Control field is cleared in the lower level driver before the frame is passed to mac80211. In such cases, the condition for ieee80211_has_protected() is not met in ieee80211_rx_h_defragment() of mac80211 and the new security validation steps are not executed. Extend mac80211 to cover the case where the Protected bit has been cleared, but the frame is indicated as having been decrypted by the hardware. This extends protection against mixed key and fragment cache attack for additional drivers/chips. This fixes CVE-2020-24586 and CVE-2020-24587 for such cases. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 Cc: stable@vger.kernel.org Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Link: https://lore.kernel.org/r/20210511200110.037aa5ca0390.I7bb888e2965a0db02a67075fcb5deb50eb7408aa@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| aead_api.c | ||
| aead_api.h | ||
| aes_ccm.h | ||
| aes_cmac.c | ||
| aes_cmac.h | ||
| aes_gcm.h | ||
| aes_gmac.c | ||
| aes_gmac.h | ||
| agg-rx.c | ||
| agg-tx.c | ||
| airtime.c | ||
| cfg.c | ||
| chan.c | ||
| debug.h | ||
| debugfs_key.c | ||
| debugfs_key.h | ||
| debugfs_netdev.c | ||
| debugfs_netdev.h | ||
| debugfs_sta.c | ||
| debugfs_sta.h | ||
| debugfs.c | ||
| debugfs.h | ||
| driver-ops.c | ||
| driver-ops.h | ||
| ethtool.c | ||
| fils_aead.c | ||
| fils_aead.h | ||
| he.c | ||
| ht.c | ||
| ibss.c | ||
| ieee80211_i.h | ||
| iface.c | ||
| Kconfig | ||
| key.c | ||
| key.h | ||
| led.c | ||
| led.h | ||
| main.c | ||
| Makefile | ||
| mesh_hwmp.c | ||
| mesh_pathtbl.c | ||
| mesh_plink.c | ||
| mesh_ps.c | ||
| mesh_sync.c | ||
| mesh.c | ||
| mesh.h | ||
| michael.c | ||
| michael.h | ||
| mlme.c | ||
| ocb.c | ||
| offchannel.c | ||
| pm.c | ||
| rate.c | ||
| rate.h | ||
| rc80211_minstrel_debugfs.c | ||
| rc80211_minstrel_ht_debugfs.c | ||
| rc80211_minstrel_ht.c | ||
| rc80211_minstrel_ht.h | ||
| rc80211_minstrel.c | ||
| rc80211_minstrel.h | ||
| rx.c | ||
| s1g.c | ||
| scan.c | ||
| spectmgmt.c | ||
| sta_info.c | ||
| sta_info.h | ||
| status.c | ||
| tdls.c | ||
| tkip.c | ||
| tkip.h | ||
| trace_msg.h | ||
| trace.c | ||
| trace.h | ||
| tx.c | ||
| util.c | ||
| vht.c | ||
| wep.c | ||
| wep.h | ||
| wme.c | ||
| wme.h | ||
| wpa.c | ||
| wpa.h | ||