diff --git a/drivers/staging/prima/CORE/TL/src/wlan_qct_tl.c b/drivers/staging/prima/CORE/TL/src/wlan_qct_tl.c index 31e7ad98266..518f6767af3 100644 --- a/drivers/staging/prima/CORE/TL/src/wlan_qct_tl.c +++ b/drivers/staging/prima/CORE/TL/src/wlan_qct_tl.c @@ -8321,6 +8321,7 @@ WLANTL_STARxConn v_PVOID_t aucBDHeader; v_U8_t ucTid; WLANTL_RxMetaInfoType wRxMetaInfo; + v_U8_t ucAsf; /* AMSDU sub frame */ /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/ /*------------------------------------------------------------------------ @@ -8371,6 +8372,7 @@ WLANTL_STARxConn usMPDULen = (v_U16_t)WDA_GET_RX_MPDU_LEN(aucBDHeader); ucMPDUHLen = (v_U8_t)WDA_GET_RX_MPDU_HEADER_LEN(aucBDHeader); ucTid = (v_U8_t)WDA_GET_RX_TID(aucBDHeader); + ucAsf = (v_U8_t)WDA_GET_RX_ASF(aucBDHeader); vos_pkt_get_packet_length( vosDataBuff, &usPktLen); @@ -8388,6 +8390,14 @@ WLANTL_STARxConn return VOS_STATUS_SUCCESS; } + if (ucAsf) { + vos_pkt_return_packet(vosDataBuff); + *pvosDataBuff = NULL; + VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR, + "WLAN TL: AMSDU frames are not allowed while authentication - dropping"); + return VOS_STATUS_SUCCESS; + } + vosStatus = WLANTL_GetEtherType(aucBDHeader,vosDataBuff,ucMPDUHLen,&usEtherType); if( VOS_IS_STATUS_SUCCESS(vosStatus) ) diff --git a/drivers/staging/prima/CORE/TL/src/wlan_qct_tl_ba.c b/drivers/staging/prima/CORE/TL/src/wlan_qct_tl_ba.c index 44549570cda..e7cf09c67e9 100644 --- a/drivers/staging/prima/CORE/TL/src/wlan_qct_tl_ba.c +++ b/drivers/staging/prima/CORE/TL/src/wlan_qct_tl_ba.c @@ -844,6 +844,8 @@ WLANTL_AMSDUProcess v_U16_t packetLength; static v_U32_t numAMSDUFrames; vos_pkt_t* vosDataBuff; + uint8_t llc_hdr[6] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00}; + /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/ /*------------------------------------------------------------------------ Sanity check @@ -922,6 +924,7 @@ WLANTL_AMSDUProcess pClientSTA->ucMPDUHeaderLen = ucMPDUHLen; vos_mem_copy(pClientSTA->aucMPDUHeader, MPDUHeaderAMSDUHeader, ucMPDUHLen); /* AMSDU header stored to handle garbage data within next frame */ + pClientSTA->drop_amsdu = false; } else { @@ -959,6 +962,25 @@ WLANTL_AMSDUProcess return VOS_STATUS_SUCCESS; /*Not a transport error*/ } + if (pClientSTA->drop_amsdu) { + vos_pkt_return_packet(vosDataBuff); + *ppVosDataBuff = NULL; + return VOS_STATUS_SUCCESS; + } + + /** + * Set drop_amsdu flag and drop AMSDU subframe if AMSDU subframe DA + * is equal to LLC header + */ + if (vos_mem_compare2(MPDUHeaderAMSDUHeader + ucMPDUHLen, llc_hdr, 6) == 0) { + pClientSTA->drop_amsdu = true; + vos_pkt_return_packet(vosDataBuff); + *ppVosDataBuff = NULL; + VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR, + "WLAN TL:Invalid AMSDU frame - dropping"); + return VOS_STATUS_SUCCESS; + } + /* Find Padding and remove */ vos_mem_copy(&subFrameLength, MPDUHeaderAMSDUHeader + ucMPDUHLen + WLANTL_AMSDU_SUBFRAME_LEN_OFFSET, sizeof(v_U16_t)); subFrameLength = vos_be16_to_cpu(subFrameLength); diff --git a/drivers/staging/prima/CORE/TL/src/wlan_qct_tli.h b/drivers/staging/prima/CORE/TL/src/wlan_qct_tli.h index c59067c347d..02ddfa6c4ea 100644 --- a/drivers/staging/prima/CORE/TL/src/wlan_qct_tli.h +++ b/drivers/staging/prima/CORE/TL/src/wlan_qct_tli.h @@ -574,6 +574,9 @@ typedef struct /* Pointer to the root of the chain */ vos_pkt_t* vosAMSDUChain; + /* Drop any invalid amsdu */ + bool drop_amsdu; + /* Used for saving/restoring frame header for 802.3/11 AMSDU sub-frames */ v_U8_t aucMPDUHeader[WLANTL_MPDU_HEADER_LEN];