[PATCH] wifi: rtw89: update PN state only from correctly decrypted frames

[PATCH] wifi: rtw89: update PN state only from correctly decrypted frames

[Zhao Li]

rtw89_core_skb_pn_valid() records the sequence and packet numbers of
hardware-decrypted QoS data frames so that it can drop frames whose
sequence number goes backwards while the PN advances. It runs before
mac80211 discards frames with an ICV/MIC or FCS error and requires only
hw_dec, so a frame that failed decryption still updates last_sn and
last_pn. Such a frame need not come from the peer. One with an advanced
sequence number and a PN between the recorded PN and the peer's next
one makes the check drop the peer's following valid frames until their
sequence numbers catch up.

Skip frames that rtw89_core_update_rx_status() does not report to
mac80211 as decrypted, or reports with an FCS error.

Found by code review and not reproduced; compile-tested only.

AI assistance was used.

Fixes: bda294ed0ed0 ("wifi: rtw89: Drop malformed AMPDU frames with abnormal PN")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
 drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 58ee5efc3b5e..a173253d51ff 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -3950,7 +3950,8 @@ static bool rtw89_core_skb_pn_valid(struct rtw89_dev *rtwdev,
 	if (!ieee80211_is_data_qos(hdr->frame_control))
 		return true;
 
-	if (!desc_info->hw_dec || !desc_info->addr1_match)
+	if (!desc_info->hw_dec || desc_info->sw_dec || desc_info->icv_err ||
+	    desc_info->crc32_err || !desc_info->addr1_match)
 		return true;
 
 	guard(rcu)();

base-commit: 5dbf2415ca9821a611d09308e3b29d2c37e7cd77
-- 
2.56.1