diff options
| author | Sriram R <srirrama@codeaurora.org> | 2021-05-11 20:02:58 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2021-05-11 20:16:21 +0200 |
| commit | c3944a5621026c176001493d48ee66ff94e1a39a (patch) | |
| tree | 2de4a8f9a7627300c5d4be07d7a07e27029a16a4 /drivers/net/wireless/ath/ath11k/mac.c | |
| parent | 62a8ff67eba52dae9b107e1fb8827054ed00a265 (diff) | |
| download | lwn-c3944a5621026c176001493d48ee66ff94e1a39a.tar.gz lwn-c3944a5621026c176001493d48ee66ff94e1a39a.zip | |
ath11k: Clear the fragment cache during key install
Currently the fragment cache setup during peer assoc is
cleared only during peer delete. In case a key reinstallation
happens with the same peer, the same fragment cache with old
fragments added before key installation could be clubbed
with fragments received after. This might be exploited
to mix fragments of different data resulting in a proper
unintended reassembled packet to be passed up the stack.
Hence flush the fragment cache on every key installation to prevent
potential attacks (CVE-2020-24587).
Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 v2
Cc: stable@vger.kernel.org
Signed-off-by: Sriram R <srirrama@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20210511200110.218dc777836f.I9af6fc76215a35936c4152552018afb5079c5d8c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath11k/mac.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath11k/mac.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index 4df425dd31a2..9d0ff150ec30 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -2779,6 +2779,12 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, */ spin_lock_bh(&ab->base_lock); peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr); + + /* flush the fragments cache during key (re)install to + * ensure all frags in the new frag list belong to the same key. + */ + if (peer && cmd == SET_KEY) + ath11k_peer_frags_flush(ar, peer); spin_unlock_bh(&ab->base_lock); if (!peer) { |