lkml.org 
[lkml]   [2022]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 116/338] ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
    Date
    From: Wen Gong <quic_wgong@quicinc.com>

    [ Upstream commit e3fb3d4418fce5484dfe7995fcd94c18b10a431a ]

    In function ath10k_wow_convert_8023_to_80211(), it will do memcpy for
    the new->pattern, and currently the new->pattern and new->mask is same
    with the old, then the memcpy of new->pattern will also overwrite the
    old->pattern, because the header format of new->pattern is 802.11,
    its length is larger than the old->pattern which is 802.3. Then the
    operation of "Copy frame body" will copy a mistake value because the
    body memory has been overwrite when memcpy the new->pattern.

    Assign another empty value to new_pattern to avoid the overwrite issue.

    Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049

    Fixes: fa3440fa2fa1 ("ath10k: convert wow pattern from 802.3 to 802.11")
    Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
    Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
    Link: https://lore.kernel.org/r/20211222031347.25463-1-quic_wgong@quicinc.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath10k/wow.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c
    index a6b179f88d36..1d44227d107d 100644
    --- a/drivers/net/wireless/ath/ath10k/wow.c
    +++ b/drivers/net/wireless/ath/ath10k/wow.c
    @@ -235,14 +235,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif,
    if (patterns[i].mask[j / 8] & BIT(j % 8))
    bitmask[j] = 0xff;
    old_pattern.mask = bitmask;
    - new_pattern = old_pattern;

    if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) {
    - if (patterns[i].pkt_offset < ETH_HLEN)
    + if (patterns[i].pkt_offset < ETH_HLEN) {
    ath10k_wow_convert_8023_to_80211(&new_pattern,
    &old_pattern);
    - else
    + } else {
    + new_pattern = old_pattern;
    new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN;
    + }
    }

    if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-04-14 16:05    [W:3.455 / U:0.340 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site