Skip to content

Commit d4c4150

Browse files
Wen Gongsmb49
authored andcommitted
ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
BugLink: https://bugs.launchpad.net/bugs/1971497 [ Upstream commit e3fb3d4 ] In function ath10k_wow_convert_8023_to_80211(), it will do memcpy for the new->pattern, and currently the new->pattern and new->mask is same with the old, then the memcpy of new->pattern will also overwrite the old->pattern, because the header format of new->pattern is 802.11, its length is larger than the old->pattern which is 802.3. Then the operation of "Copy frame body" will copy a mistake value because the body memory has been overwrite when memcpy the new->pattern. Assign another empty value to new_pattern to avoid the overwrite issue. Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049 Fixes: fa3440f ("ath10k: convert wow pattern from 802.3 to 802.11") Signed-off-by: Wen Gong <[email protected]> Signed-off-by: Kalle Valo <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Sasha Levin <[email protected]> Signed-off-by: Kamal Mostafa <[email protected]> Signed-off-by: Stefan Bader <[email protected]>
1 parent 57ae5b7 commit d4c4150

File tree

1 file changed

+4
-3
lines changed
  • drivers/net/wireless/ath/ath10k

1 file changed

+4
-3
lines changed

drivers/net/wireless/ath/ath10k/wow.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif,
337337
if (patterns[i].mask[j / 8] & BIT(j % 8))
338338
bitmask[j] = 0xff;
339339
old_pattern.mask = bitmask;
340-
new_pattern = old_pattern;
341340

342341
if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) {
343-
if (patterns[i].pkt_offset < ETH_HLEN)
342+
if (patterns[i].pkt_offset < ETH_HLEN) {
344343
ath10k_wow_convert_8023_to_80211(&new_pattern,
345344
&old_pattern);
346-
else
345+
} else {
346+
new_pattern = old_pattern;
347347
new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN;
348+
}
348349
}
349350

350351
if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))

0 commit comments

Comments
 (0)