wifi: mt76: mt7996: drop fragments with multicast or broadcast RA

IEEE 802.11 fragmentation can only be applied to unicast frames.
Therefore, drop fragments with multicast or broadcast RA. This patch
addresses vulnerabilities such as CVE-2020-26145.

Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://patch.msgid.link/20250515032952.1653494-4-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 771c16e8d10c46bd2cfafd5f2d2298a0325d9047..0dbd4662bc842947abf09f9ae3aa4a1d4b86cba8 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -647,6 +647,14 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
                status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME;
        }
 
+       /* IEEE 802.11 fragmentation can only be applied to unicast frames.
+        * Hence, drop fragments with multicast/broadcast RA.
+        * This check fixes vulnerabilities, like CVE-2020-26145.
+        */
+       if ((ieee80211_has_morefrags(fc) || seq_ctrl & IEEE80211_SCTL_FRAG) &&
+           FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) != MT_RXD3_NORMAL_U2M)
+               return -EINVAL;
+
        hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
        if (hdr_trans && ieee80211_has_morefrags(fc)) {
                if (mt7996_reverse_frag0_hdr_trans(skb, hdr_gap))