CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/20 05:59:15
Modified files:
sys/dev/ic : bwfm.c bwfmvar.h
sys/dev/pci : if_bwfm_pci.c
sys/dev/sdmmc : if_bwfm_sdio.c
sys/dev/usb : if_bwfm_usb.c
Log message:
Provide out-of-band information about firmware events to bwfm_rx().
This allows the driver to ignore firmware events which did not actually
arrive on a firmware event Rx ring. An exception are USB devices which
seem to only offer a single Rx pipe across which data frames and firmware
events are multiplexed.
Previously, firmware events were detected purely based on attributes of
the ethernet header in a received frame, which could potentially be a
crafted header in frames received on the air, injecting firmware events
into the driver from the outside.
I am unsure if such injection can happen on real hardware. It will depend
on the firmware being careful enough about filtering out event frames it
did not generate itself. The corresponding report by Acts1631 was triggering
the problem by calling bwfm_rx() manually with crafted ethernet packets.
But this is worth hardening nonetheless, and the Linux brcmfmac driver
has a similar check in place.
Tested by martijn@ on PCI in hostap mode and by myself on USB on client mode.
