• Sara Sharon's avatar
    iwlwifi: mvm: fix security bug in PN checking · 5ab2ba93
    Sara Sharon authored
    A previous patch allowed the same PN for packets originating from the
    same AMSDU by copying PN only for the last packet in the series.
    
    This however is bogus since we cannot assume the last frame will be
    received on the same queue, and if it is received on a different ueue
    we will end up not incrementing the PN and possibly let the next
    packet to have the same PN and pass through.
    
    Change the logic instead to driver explicitly indicate for the second
    sub frame and on to be allowed to have the same PN as the first
    subframe. Indicate it to mac80211 as well for the fallback queue.
    
    Fixes: f1ae02b1 ("iwlwifi: mvm: allow same PN for de-aggregated AMSDU")
    Signed-off-by: default avatarSara Sharon <sara.sharon@intel.com>
    Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
    5ab2ba93
rxmq.c 33.9 KB