From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 574ECC00528 for ; Fri, 4 Aug 2023 10:28:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229711AbjHDK2k (ORCPT ); Fri, 4 Aug 2023 06:28:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39668 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231217AbjHDK2e (ORCPT ); Fri, 4 Aug 2023 06:28:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54E7849EC; Fri, 4 Aug 2023 03:28:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 98E4261F89; Fri, 4 Aug 2023 10:28:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83A5CC433C8; Fri, 4 Aug 2023 10:28:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1691144901; bh=QoEsYNbjsFFAbciklJ7lF0/x8SccEJnHPlvLfQ6xsLE=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=uFbH5vBM8CBeZgwU32UOseiNmn3vZkQ2Q01WdpbKuXu4YKCK8JcQmlUGtpdhm1Z2i azg1TGfXTlwawzDxzBwx/Kgwyz8Te9nSyOIv1gOUMX9JdGlAyd7xjJXL6/P4Q1Vs14 846YHdjwSi8nlPFXzdar6pH72nZUU9mCJfEG2Vr0= Date: Fri, 4 Aug 2023 12:28:18 +0200 From: Greg Kroah-Hartman To: Ashwin Dayanand Kamat Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Wen Gong , Jouni Malinen , Johannes Berg , davem@davemloft.net, ath10k@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, akaher@vmware.com, vsirnapalli@vmware.com, tkundu@vmware.com, namit@vmware.com Subject: Re: [PATCH v4.19.y] ath10k: Fix TKIP Michael MIC verification for PCIe Message-ID: <2023080408-squad-pony-2638@gregkh> References: <1690971733-22270-1-git-send-email-kashwindayan@vmware.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1690971733-22270-1-git-send-email-kashwindayan@vmware.com> Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Wed, Aug 02, 2023 at 03:52:13PM +0530, Ashwin Dayanand Kamat wrote: > From: Wen Gong > > commit 0dc267b13f3a7e8424a898815dd357211b737330 upstream. > > TKIP Michael MIC was not verified properly for PCIe cases since the > validation steps in ieee80211_rx_h_michael_mic_verify() in mac80211 did > not get fully executed due to unexpected flag values in > ieee80211_rx_status. > > Fix this by setting the flags property to meet mac80211 expectations for > performing Michael MIC validation there. This fixes CVE-2020-26141. It > does the same as ath10k_htt_rx_proc_rx_ind_hl() for SDIO which passed > MIC verification case. This applies only to QCA6174/QCA9377 PCIe. > > Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 > > Cc: stable@vger.kernel.org > Signed-off-by: Wen Gong > Signed-off-by: Jouni Malinen > Link: https://lore.kernel.org/r/20210511200110.c3f1d42c6746.I795593fcaae941c471425b8c7d5f7bb185d29142@changeid > Signed-off-by: Johannes Berg > Signed-off-by: Ashwin Dayanand Kamat > --- > drivers/net/wireless/ath/ath10k/htt_rx.c | 10 ++++++++++ > 1 file changed, 10 insertions(+) > Now queued up, thanks. greg k-h