forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2023-12-08 01573e231f18eb2d99162747186f59511f56b64d 
 kernel/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_recv.c
....@@ -2146,17 +2146,6 @@
21462146 		goto exit;
21472147 	}
21482148 
2149
-	if ((psta->flags & WLAN_STA_AMSDU_DISABLE) && pattrib->amsdu) {
2150
-		#ifdef DBG_RX_DROP_FRAME
2151
-		RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT" amsdu not allowed"MAC_FMT"\n"
2152
-			, FUNC_ADPT_ARG(adapter), MAC_ARG(psta->cmn.mac_addr));
2153
-		#endif
2154
-		ret = _FAIL;
2155
-		goto exit;
2156
-	
2157
-	}
2158
-
2159
-
21602149 	precv_frame->u.hdr.psta = psta;
21612150 	precv_frame->u.hdr.preorder_ctrl = NULL;
21622151 	pattrib->ack_policy = 0;
....@@ -2204,87 +2193,6 @@
22042193 			#endif
22052194 			ret = _FAIL;
22062195 			goto exit;
2207
-		}
2208
-	}
2209
-
2210
-	if (pattrib->privacy) {
2211
-#ifdef CONFIG_TDLS
2212
-		if ((psta->tdls_sta_state & TDLS_LINKED_STATE) && (psta->dot118021XPrivacy == _AES_))
2213
-			pattrib->encrypt = psta->dot118021XPrivacy;
2214
-		else
2215
-#endif /* CONFIG_TDLS */
2216
-			GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, IS_MCAST(pattrib->ra));
2217
-
2218
-
2219
-		SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
2220
-	} else {
2221
-		pattrib->encrypt = 0;
2222
-		pattrib->iv_len = pattrib->icv_len = 0;
2223
-	}
2224
-
2225
-	/* drop unprotected frame in protected network. */
2226
-	if (psecuritypriv->dot11PrivacyAlgrthm != _NO_PRIVACY_ ) {
2227
-		if (IS_MCAST(pattrib->ra)) {
2228
-			if (!pattrib->privacy) {
2229
-			#ifdef DBG_RX_DROP_FRAME
2230
-				RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT"recv plaintext bmc packet for sta="MAC_FMT"\n"
2231
-					, FUNC_ADPT_ARG(adapter), MAC_ARG(psta->cmn.mac_addr));
2232
-			#endif
2233
-				ret = _FAIL;
2234
-				goto exit;
2235
-			}
2236
-		} else {
2237
-			/* unicast */
2238
-			u16 ether_type;
2239
-			u8* ether_ptr = NULL;
2240
-			u16  eapol_type = 0x888e;
2241
-			ether_ptr = ptr + pattrib->hdrlen + pattrib->iv_len + RATTRIB_GET_MCTRL_LEN(pattrib) + LLC_HEADER_SIZE;
2242
-			_rtw_memcpy(&ether_type, ether_ptr, 2);
2243
-			ether_type = ntohs((unsigned short)ether_type);
2244
-	
2245
-			if (psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) {
2246
-				/* CVE-2020-26140, CVE-2020-26143, CVE-2020-26147,	let eapol packet go through*/
2247
-				if (!pattrib->privacy && ether_type != eapol_type ) {
2248
-				#ifdef DBG_RX_DROP_FRAME
2249
-					RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT"recv plaintext unicast packet for sta="MAC_FMT"\n"
2250
-					, FUNC_ADPT_ARG(adapter), MAC_ARG(psta->cmn.mac_addr));
2251
-				#endif
2252
-					ret = _FAIL;
2253
-					goto exit;
2254
-				}
2255
-				/* CVE-2020-26144, pevernt plaintext A-MSDU */
2256
-				/* This can prevent plantext A-MSDU cloacked as an EAPOL frame */
2257
-				if (!pattrib->privacy && pattrib->amsdu) {
2258
-				#ifdef DBG_RX_DROP_FRAME
2259
-					RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT"recv plaintext A-MSDU for sta="MAC_FMT"\n"
2260
-					, FUNC_ADPT_ARG(adapter), MAC_ARG(psta->cmn.mac_addr));
2261
-				#endif
2262
-					ret = _FAIL;
2263
-					goto exit;
2264
-				}
2265
-				/* CVE-2020-26139,	Drop any forwarding eapol packet until 4-way has done.	*/
2266
-				if ((ether_type == eapol_type)
2267
-					&& (MLME_IS_AP(adapter) || MLME_IS_MESH(adapter))
2268
-					&& (psta->dot118021XPrivacy == _NO_PRIVACY_)
2269
-					&& (!_rtw_memcmp( adapter_mac_addr(adapter), pattrib->dst, ETH_ALEN))) {
2270
-				#ifdef DBG_RX_DROP_FRAME
2271
-					RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT" recv eapol packet forwarding(dst:"MAC_FMT") before 4-way finish.\n"
2272
-						, FUNC_ADPT_ARG(adapter), MAC_ARG(pattrib->dst));
2273
-				#endif
2274
-					ret = _FAIL;
2275
-					goto exit;
2276
-				}
2277
-			} else {
2278
-				/* CVE-2020-26140, CVE-2020-26143, CVE-2020-26147 */
2279
-				if (!pattrib->privacy) {
2280
-			#ifdef DBG_RX_DROP_FRAME
2281
-				RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT"recv plaintext packet for sta="MAC_FMT"\n"
2282
-					, FUNC_ADPT_ARG(adapter), MAC_ARG(psta->cmn.mac_addr));
2283
-			#endif
2284
-				ret = _FAIL;
2285
-				goto exit;
2286
-				}
2287
-			}
22882196 		}
22892197 	}
22902198 
....@@ -2640,10 +2548,6 @@
26402548 	union recv_frame *prframe, *pnextrframe;
26412549 	_queue	*pfree_recv_queue;
26422550 
2643
-	u8 *pdata = NULL;
2644
-	u64 tmp_iv_hdr = 0;
2645
-	u64 pkt_pn = 0, cur_pn = 0;
2646
-	struct rx_pkt_attrib *pattrib = NULL;
26472551 
26482552 	curfragnum = 0;
26492553 	pfree_recv_queue = &adapter->recvpriv.free_recv_queue;
....@@ -2651,15 +2555,6 @@
26512555 	phead = get_list_head(defrag_q);
26522556 	plist = get_next(phead);
26532557 	prframe = LIST_CONTAINOR(plist, union recv_frame, u);
2654
-	/* CVE-2020-26146 */
2655
-	pattrib = &prframe->u.hdr.attrib;
2656
-	if (pattrib->encrypt == _AES_  || pattrib->encrypt == _CCMP_256_
2657
-		|| pattrib->encrypt == _GCMP_ || pattrib->encrypt == _GCMP_256_ ) {
2658
-		pdata = prframe->u.hdr.rx_data;
2659
-		tmp_iv_hdr = le64_to_cpu(*(u64*)(pdata + pattrib->hdrlen));
2660
-		/* get the first frame's PN. */
2661
-		cur_pn = CCMPH_2_PN(tmp_iv_hdr);
2662
-	}	
26632558 	pfhdr = &prframe->u.hdr;
26642559 	rtw_list_delete(&(prframe->u.list));
26652560 
....@@ -2689,33 +2584,6 @@
26892584 	while (rtw_end_of_queue_search(phead, plist) == _FALSE) {
26902585 		pnextrframe = LIST_CONTAINOR(plist, union recv_frame , u);
26912586 		pnfhdr = &pnextrframe->u.hdr;
2692
-		/* CVE-2020-26146, check whether the PN is consecutive. */
2693
-		pattrib = &pnextrframe->u.hdr.attrib;
2694
-		if (pattrib->encrypt == _AES_  || pattrib->encrypt == _CCMP_256_
2695
-			|| pattrib->encrypt == _GCMP_ || pattrib->encrypt == _GCMP_256_ ) {
2696
-			pdata = pnextrframe->u.hdr.rx_data;
2697
-			tmp_iv_hdr = le64_to_cpu(*(u64*)(pdata + pattrib->hdrlen));
2698
-			pkt_pn = CCMPH_2_PN(tmp_iv_hdr);
2699
-			if (pkt_pn != cur_pn + 1) {
2700
-				RTW_INFO("%s non-consective PN! old:%llu, new:%llu\n",
2701
-					__func__, cur_pn, pkt_pn);
2702
-				/* PN must be consecutive */
2703
-				/* release the defrag_q & prframe */
2704
-				rtw_free_recvframe(prframe, pfree_recv_queue);
2705
-				rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
2706
-				return NULL;
2707
-			} else {
2708
-				cur_pn = pkt_pn;
2709
-			}
2710
-		}
2711
-		
2712
-		/* CVE-2020-24587, The keytrack of the fragment is supposed to be the same with other's */
2713
-		if (pfhdr->keytrack != pnfhdr->keytrack) {
2714
-			RTW_INFO("Inconsistent key track, drop fragmented frame!\n");
2715
-			rtw_free_recvframe(prframe, pfree_recv_queue);
2716
-			rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
2717
-			return NULL;
2718
-		}
27192587 
27202588 
27212589 		/* check the fragment sequence  (2nd ~n fragment frame) */
....@@ -2728,21 +2596,14 @@
27282596 			return NULL;
27292597 		}
27302598 
2599
+		curfragnum++;
2600
+
27312601 		/* copy the 2nd~n fragment frame's payload to the first fragment */
27322602 		/* get the 2nd~last fragment frame's payload */
27332603 
27342604 		wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
27352605 
27362606 		recvframe_pull(pnextrframe, wlanhdr_offset);
2737
-
2738
-		if ((pfhdr->rx_end - pfhdr->rx_tail) < pnfhdr->len) {
2739
-			RTW_INFO("Not enough buffer space, drop fragmented frame!\n");
2740
-			rtw_free_recvframe(prframe, pfree_recv_queue);
2741
-			rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
2742
-			return NULL;
2743
-		}
2744
-
2745
-		curfragnum++;
27462607 
27472608 		/* append  to first fragment frame's tail (if privacy frame, pull the ICV) */
27482609 		recvframe_pull_tail(prframe, pfhdr->attrib.icv_len);
....@@ -2804,17 +2665,6 @@
28042665 
28052666 	if ((ismfrag == 0) && (fragnum == 0)) {
28062667 		prtnframe = precv_frame;/* isn't a fragment frame */
2807
-	} else {
2808
-		/* CVE-2020-26145, group addressed frame cannot use fragmentation!! */
2809
-		if (IS_MCAST(pfhdr->attrib.ra)) {
2810
-			RTW_INFO("DROP group addressed fragment!\n");
2811
-			rtw_free_recvframe(precv_frame, pfree_recv_queue);
2812
-			return NULL;
2813
-		}
2814
-		/* CVE-2020-24587 */
2815
-		if ((psta) && (pdefrag_q))
2816
-			precv_frame->u.hdr.keytrack = ATOMIC_READ(&psta->keytrack);
2817
-		
28182668 	}
28192669 
28202670 	if (ismfrag == 1) {
....@@ -3052,47 +2902,6 @@
30522902 }
30532903 #endif /* defined(CONFIG_AP_MODE) || defined(CONFIG_RTW_MESH) */
30542904 
3055
-/*
3056
- * From WFA suggestion:						*
3057
- * If first subframe meets one of the following condition,	*
3058
- * the whole received AMSDU should drop.			*
3059
- * 1. subframe's DA is not the same as RA in From DS case.	*
3060
- * 2. subframe's SA is not the same as TA in To DS case.	*
3061
- * 3. subframe's DA is AA:AA:03:00:00:00			*
3062
-								*/
3063
-static u8 validate_amsdu_content(_adapter *padapter, union recv_frame *prframe,
3064
-	const u8 *da, const u8 *sa)
3065
-{
3066
-	struct rx_pkt_attrib	*pattrib = &prframe->u.hdr.attrib;
3067
-	u8 ret = _SUCCESS;
3068
-
3069
-	/* Use the recommendation method form Wi-Fi alliance to check subframe */
3070
-	/* in protected network */
3071
-	if (padapter->registrypriv.amsdu_mode == RTW_AMSDU_MODE_NON_SPP &&
3072
-		padapter->securitypriv.dot11PrivacyAlgrthm != _NO_PRIVACY_) {
3073
-
3074
-		/* 1.check From DS */
3075
-		if (pattrib->to_fr_ds == 2) {
3076
-			if (_rtw_memcmp(da, pattrib->ra, ETH_ALEN) == _FALSE)
3077
-			ret = _FAIL;
3078
-		}
3079
-
3080
-		/* 2.check To DS */
3081
-		if (pattrib->to_fr_ds == 1) {
3082
-			if (_rtw_memcmp(sa, pattrib->ta, ETH_ALEN) == _FALSE)
3083
-			ret = _FAIL;
3084
-		}
3085
-
3086
-		/* 3.Check whether DA is AA:AA:03:00:00:00 */
3087
-		if (_rtw_memcmp(da, rtw_rfc1042_header, ETH_ALEN) == _TRUE)
3088
-			ret = _FAIL;
3089
-
3090
-	}
3091
-
3092
-	return ret;
3093
-
3094
-}
3095
-
30962905 int amsdu_to_msdu(_adapter *padapter, union recv_frame *prframe)
30972906 {
30982907 	struct rx_pkt_attrib *rattrib = &prframe->u.hdr.attrib;
....@@ -3146,12 +2955,6 @@
31462955 
31472956 			v_ret = rtw_mesh_rx_data_validate_mctrl(padapter, prframe
31482957 				, mctrl, mda, msa, &mctrl_len, &da, &sa);
3149
-
3150
-			if (validate_amsdu_content(padapter, prframe, da, sa) == _FAIL) {
3151
-				RTW_INFO("%s check subframe content fail!\n", __func__);
3152
-				break;
3153
-			}
3154
-
31552958 			if (v_ret != _SUCCESS)
31562959 				goto move_to_next;
31572960 
....@@ -3165,12 +2968,6 @@
31652968 		{
31662969 			da = pdata;
31672970 			sa = pdata + ETH_ALEN;
3168
-
3169
-			if (validate_amsdu_content(padapter, prframe, da, sa) == _FAIL) {
3170
-				RTW_INFO("%s check subframe content fail!\n", __func__);
3171
-				break;
3172
-			}
3173
-
31742971 			llc_hdl = rtw_recv_llc_parse(pdata + ETH_HLEN, nSubframe_Length);
31752972 			#ifdef CONFIG_AP_MODE
31762973 			if (MLME_IS_AP(padapter)) {
....@@ -4867,13 +4664,9 @@
48674664 	s32 err = _SUCCESS;
48684665 #ifdef RTW_RECV_THREAD_HIGH_PRIORITY
48694666 #ifdef PLATFORM_LINUX
4870
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0))
4871
-	sched_set_fifo_low(current);
4872
-#else
48734667 	struct sched_param param = { .sched_priority = 1 };
4874
-				
4668
+
48754669 	sched_setscheduler(current, SCHED_FIFO, &param);
4876
-#endif
48774670 #endif /* PLATFORM_LINUX */
48784671 #endif /*RTW_RECV_THREAD_HIGH_PRIORITY*/
48794672 	thread_enter("RTW_RECV_THREAD");