• Bjørn Mork's avatar
    net: qmi_wwan: fixup destination address (firmware bug workaround) · 6483bdc9
    Bjørn Mork authored
    Received packets are sometimes addressed to 00:a0:c6:00:00:00
    instead of the address the device firmware should have learned
    from the host:
    
    321.224126 77.16.85.204 -> 148.122.171.134 ICMP 98 Echo (ping) request  id=0x4025, seq=64/16384, ttl=64
    
    0000  82 c0 82 c9 f1 67 82 c0 82 c9 f1 67 08 00 45 00   .....g.....g..E.
    0010  00 54 00 00 40 00 40 01 57 cc 4d 10 55 cc 94 7a   .T..@.@.W.M.U..z
    0020  ab 86 08 00 62 fc 40 25 00 40 b2 bc 6e 51 00 00   ....b.@%.@..nQ..
    0030  00 00 6b bd 09 00 00 00 00 00 10 11 12 13 14 15   ..k.............
    0040  16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25   .......... !"#$%
    0050  26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35   &'()*+,-./012345
    0060  36 37                                             67
    
    321.240607 148.122.171.134 -> 77.16.85.204 ICMP 98 Echo (ping) reply    id=0x4025, seq=64/16384, ttl=55
    
    0000  00 a0 c6 00 00 00 02 50 f3 00 00 00 08 00 45 00   .......P......E.
    0010  00 54 00 56 00 00 37 01 a0 76 94 7a ab 86 4d 10   .T.V..7..v.z..M.
    0020  55 cc 00 00 6a fc 40 25 00 40 b2 bc 6e 51 00 00   U...j.@%.@..nQ..
    0030  00 00 6b bd 09 00 00 00 00 00 10 11 12 13 14 15   ..k.............
    0040  16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25   .......... !"#$%
    0050  26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35   &'()*+,-./012345
    0060  36 37                                             67
    
    The bogus address is always the same, and matches the address
    suggested by many devices as a default address.  It is likely a
    hardcoded firmware default.
    
    The circumstances where this bug has been observed indicates that
    the trigger is related to timing or some other factor the host
    cannot control. Repeating the exact same configuration sequence
    that caused it to trigger once, will not necessarily cause it to
    trigger the next time. Reproducing the bug is therefore difficult.
    This opens up a possibility that the bug is more common than we can
    confirm, because affected devices often will work properly again
    after a reset.  A procedure most users are likely to try out before
    reporting a bug.
    
    Unconditionally rewriting the destination address if the first digit
    of the received packet is 0, is considered an acceptable compromise
    since we already have to inspect this digit.  The simplification will
    cause unnecessary rewrites if the real address starts with 0, but this
    is still better than adding additional tests for this particular case.
    Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    6483bdc9
Name
Last commit
Last update
Documentation Loading commit data...
arch Loading commit data...
block Loading commit data...
crypto Loading commit data...
drivers Loading commit data...
firmware Loading commit data...
fs Loading commit data...
include Loading commit data...
init Loading commit data...
ipc Loading commit data...
kernel Loading commit data...
lib Loading commit data...
mm Loading commit data...
net Loading commit data...
samples Loading commit data...
scripts Loading commit data...
security Loading commit data...
sound Loading commit data...
tools Loading commit data...
usr Loading commit data...
virt/kvm Loading commit data...
.gitignore Loading commit data...
.mailmap Loading commit data...
COPYING Loading commit data...
CREDITS Loading commit data...
Kbuild Loading commit data...
Kconfig Loading commit data...
MAINTAINERS Loading commit data...
Makefile Loading commit data...
README Loading commit data...
REPORTING-BUGS Loading commit data...