Merge "qcacld-3.0: Drop mcast and plaintext frags in protected network" into wlan-cld3.driver.lnx.2.0.r18
diff --git a/core/dp/txrx/ol_rx_defrag.c b/core/dp/txrx/ol_rx_defrag.c
index 2d0a15b..bfaef16 100644
--- a/core/dp/txrx/ol_rx_defrag.c
+++ b/core/dp/txrx/ol_rx_defrag.c
@@ -414,6 +414,8 @@
struct ol_rx_reorder_array_elem_t *rx_reorder_array_elem;
uint16_t frxseq, rxseq, seq;
htt_pdev_handle htt_pdev = pdev->htt_pdev;
+ void *rx_desc;
+ uint8_t index;
seq = seq_num & peer->tids_rx_reorder[tid].win_sz_mask;
qdf_assert(seq == 0);
@@ -427,6 +429,28 @@
IEEE80211_SEQ_FRAG_MASK;
more_frag = mac_hdr->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
+ rx_desc = htt_rx_msdu_desc_retrieve(htt_pdev, frag);
+ qdf_assert(htt_rx_msdu_has_wlan_mcast_flag(htt_pdev, rx_desc));
+ index = htt_rx_msdu_is_wlan_mcast(htt_pdev, rx_desc) ?
+ txrx_sec_mcast : txrx_sec_ucast;
+
+ /*
+ * Multicast/Broadcast frames should not be fragmented so drop
+ * such frames.
+ */
+ if (index != txrx_sec_ucast) {
+ ol_rx_frames_free(htt_pdev, frag);
+ return;
+ }
+
+ if (peer->security[index].sec_type != htt_sec_type_none &&
+ !htt_rx_mpdu_is_encrypted(htt_pdev, rx_desc)) {
+ ol_txrx_err("Unencrypted fragment received in security mode %d",
+ peer->security[index].sec_type);
+ ol_rx_frames_free(htt_pdev, frag);
+ return;
+ }
+
if ((!more_frag) && (!fragno) && (!rx_reorder_array_elem->head)) {
rx_reorder_array_elem->head = frag;
rx_reorder_array_elem->tail = frag;